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YEAR 2000 COMPUTER PROBLEM 


THURSDAY, MAY 7, 1998 

House of Representatives, 

Committee on Ways and Means, 

Subcommittee on Oversight, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 10 a.m., in room 
B-318, Rayburn House Office Building, Hon. Nancy L. Johnson 
(Chairman of the Subcommittee) presiding. 

[The advisory announcing the hearing follows:] 


( 1 ) 
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ADVISORY 

FROM THE COMMITTEE ON WAYSAND MEANS 
SUBCOMMITTEE ON OVERSIGHT 

FOR IMMEDIATE RELEASE CONTACT: (202) 225-7601 

April 30, 1998 
No. OV-17 


J ohnson Announces Hearing on the 
Year 2000 Computer Problem 


Congresswoman Nancy L. Johnson (R-CT), Chairman, Subcommittee on Over- 
sight of the Committee on Ways and Means, today announced that the Subcommit- 
tee will hold a hearing on the potential effects of the year 2000 (Y2K) computer 
problem on the Federal programs within the jurisdiction of the Committee on Ways 
and Means. The hearing will take place on Thursday, May 7, 1998, in room B-318 
Rayburn Flouse Office Building, beginning at 10:00 a.m. 

In view of the limited time available to hear witnesses, oral testimony at this 
hearing will be from invited witnesses only. Witnesses will include individuals testi- 
fying on behalf of the U.S. Departments of the Treasury and Flealth and Fluman 
Services, the Social Security Administration, the Office of Management and Budget 
and the U.S. General Accounting Office, as well as the private sector. Flowever, any 
individual or organization not scheduled for an oral appearance may submit a writ- 
ten statement for consideration by the Committee and for inclusion in the printed 
record of the hearing. 


BACKGROUND: 


Most computers and computer systems in use in the Federal Government today 
will not be able to function beyond the year 2000 unless they are modified. In par- 
ticular, this applies with respect to the Federal programs within the jurisdiction of 
the Committee on Ways and Means, including those administered by the U.S. De- 
partment of the Treasury, U.S. Department of Flealth and Fluman Services, and the 
Social Security Administration. 

Some computers cannot be modified and must be replaced. In addition, there are 
many items, like elevators or security systems, that are not directly related to com- 
puter systems which have embedded computer chips. Many of these chips are date 
dependent and require replacement in order to function beyond theyear 2000. 

Currently most computers only store a two-digit number for the year, which 
makes the year 2000 indistinguishable from the year 1900. Computer operating sys- 
tems and applications software that are dependent upon this two-digit year format 
will likely malfunction. Incorrect notices, penalty assessments, refund or beneficiary 
checks could result. Without proper renovation, computer malfunctions will cause 
many costly problems for both commerce and government. 

While fixing the two-digit year field is technically simple, the process of analyzing, 
renovating, and testing software and hardware for all computer systems that must 
interact is a very complex management task. For most of the Federal Government's 
computer systems, it is too impractical and expensive to purchase a completely new 
system. Most software must be modified to accommodate four-digit years or to incor- 
porate some other interim solution. To determine whether a computer system needs 
to be modified, all of its software code must be reviewed, which can entail reading 
hundreds, or millions, of lines of computer code. The process of reading and inter- 
preting the code is made more difficult by the many computer languages in use 
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today and the shortage of programmers with skills in older languages. Most older 
programs which have been modified thousands of times over the years, no longer 
have the accompanying documentation. 

A further complication is that there is no single solution to be used to renovate 
computer systems for the year 2000. Rather, there are dozens of standards, public 
and proprietary, for storing and processing dates in computers. 

Although some may have doubted the seriousness of this problem a few years ago 
or had not focused on the potential risks to the success of their programs and sys- 
tems, most business managers and government officials are now convinced that this 
will be a difficult and time-consuming management challenge. Federal agencies 
have established Y2K program offices, and an interagency committee has overseen 
government-wide actions. The century date change is a worldwide problem affecting 
every industry, locally, nationally, and internationally. 

The information gained in this hearing will be helpful to Congress in evaluating 
the progress made by each agency in renovating its computer systems and in deter- 
mining whether legislation or other congressional action is necessary to help ensure 
that renovation is successful and timely. 

In announcing the hearing. Chairman J ohnson stated: "We have a very real prob- 
lem with a very real deadline. The programs within our Committee's jurisdiction af- 
fect more than 260 million Americans. Our revenue programs affect every taxpayer 
and every business. Millions rely on our benefit programs for their health and well 
being. These people need assurance that the services that they rely on will not be 
disrupted by a computer failure. Today we are assessing the adequacy of the plan- 
ning and management of the bureaus within the Committee's jurisdiction to avert 
a potential disaster." 


FOCUS OF THE HEARING: 


The hearing will explore the Y2K issues for the major program areas within the 
jurisdiction of the Committee on Ways and Means. In particular the Subcommittee 
will examine the implications of the Y2K computer problem for the various program 
beneficiaries, the potential risks to program missions, and major remaining program 
vulnerabilities. 


DETAILS FOR SUBMISSION OF WRITTEN COMMENTS: 


Any person or organization wishing to submit a written statement for the printed 
record of the hearing should submit six (6) single-spaced copies of their statement, 
along with an IBM compatible 3.5-inch diskette in WordPerfect 5.1 format, with 
their name, address, and hearing date noted on a label, by the close of business, 
Thursday, May 21, 1998, to A.L. Singleton, Chief of Staff, Committee on Ways and 
Means, U.S. Flouse of Representatives, 1102 Longworth Flouse Office Building, 
Washington, D.C. 20515. If those filing written statements wish to have their state- 
ments distributed to the press and interested public at the hearing, they may de- 
liver 200 additional copies for this purpose to the Subcommittee on Oversight office, 
room 1136 Longworth Flouse Office Building, at least one hour before the hearing 
begins. 


FORMATTING REQUIREMENTS: 

Each statement presented for printing to the Committee by a witness, any written statement 
or exhibit submitted for the printed record or any written comments in response to a request 
for written comments must conform to the guidelines listed below. Any statement or exhibit not 
in compliance with these guidelines will not be printed, but will be maintained in the Committee 
files for review and use by the Committee. 

1. All statements and any accompanying exhibits for printing must be submitted on an IBM 
compatible 3.5-inch diskette in WordPerfect 5.1 format, typed in single space and may not ex- 
ceed a total of 10 pages including attachments. Witnesses are advised that the Committee will 
rely on electronic submissions for printing the official hearing record. 

2. Copies of whole documents submitted as exhibit material will not be accepted for printing. 
Instead, exhibit material should be referenced and quoted or paraphrased. All exhibit material 
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not meeting these specifications wiii be maintained in the Committee fiies for review and use 
by the Committee. 

3. A witness appearing at a pubiic hearing, or submitting a statement for the record of a pub- 
iic hearing, or submitting written comments in response to a pubiished request for comments 
by the Committee, must inciude on his statement or submission a iist of aii dients, persons, 
or organizations on whose behaif the witness appears. 

4. A suppiementai sheet must accompany each statement iisting the name, company, address, 
teiephone and fax numbers where the witness or the designated representative may be reached. 
This suppiementai sheet wiii not be inciuded in the printed record. 

The above restrictions and iimitations appiy oniy to materiai being submitted for printing. 
Statements and exhibits or suppiementary materiai submitted solely for distribution to the 
Members, the press, and the public during the course of a public hearing may be submitted in 
other forms. 


Note: All Committee advisories and news releases are available on the World 
Wide Web at 'http://WWW.HOUSE.GOV/WAYS_MEANS/'. 


The Committee seeks to make Its facilities accessible to persons with disabilities. 
If you are In need of special accommodations, please call 202-225-1721 or 202-226- 
3411 TTD/TTY In advance of the event (four business days notice Is r^uested). 
Ouestlons with regard to special accommodation needs In general (Including avail- 
ability of Committee materials In alternative formats) may be directed to the Com- 
mittee as noted above. 


Chairman Johnson of Connecticut [presiding]. Good morning, 
and weicome to aii of you this morning, i am sorry that there are 
not chairs enough for everyone, but if experience is a guide, there 
wiii be. 

Hardiy a day goes by when we don't read a newspaper articie or 
see a story on teievision about the year 2000. A probiem with its 
own catchy acronym, Y2K, that is quickiy becoming a househoid 
word. Some have suggested that we are headed toward a miiien- 
nium meitdown with a high probabiiity of a nationwide recession. 
Others have suggested it wiii mereiy be annoying. 

Changing the date fieid to distinguish between J anuary 1, 2000 
and 1900 is not technicaiiy difficuit. What is chaiienging, however, 
is finding the data fieids in oid undocumented computer programs 
and searching for date-dependent computer chips embedded in non- 
computer systems, such as eievators and security systems. Each 
must be modified in order to function in the year 2000. The enor- 
mity of the probiem becomes evident when you consider that these 
modifications must be made by every organization, pubiic and pri- 
vate, on every computer system that considers dates in any man- 
ner. Then, aii those modified systems must be integrated and test- 
ed to make certain they produce consistent and accurate resuits. 

J ust in the Federai agencies aione, we have more than 7,850 
mission-criticai systems which must be abie to function correctiy by 
the year 2000. Of these mission-criticai systems, 1,126 are within 
this Committee's jurisdiction, and neariy aii must be abie to ex- 
change information with each other. State and iocai systems, and 
private sector systems to be abie to make proper caicuiations for 
miiiions of Sociai Security recipients. Medicare beneficiaries, and 
taxpayers. These systems must be abie to keep accurate beneficiary 
records and taxpayer accounts. 
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What has become evident to me is that this is a major manage- 
ment problem with a technical component. The Federal Govern- 
ment is not known for its ability to manage well, particularly its 
computer system modernization efforts. Yet, millions of bene- 
ficiaries and taxpayers find themselves relying on these managers 
to rise to the year 2000 challenge. While it is hard to have com- 
plete confidence in agencies that historically have been unable to 
successfully deliver computer systems that function properly and 
on schedule, J anuary 1, 2000, is a finite date that cannot be missed 
without affecting millions and millions of Americans. It is our job 
in Congress to see that beneficiaries and taxpayers are protected 
against risks that may result in computer error systems from gov- 
ernment systems that are not year 2000 compliant. 

We're here today to hear from the major agencies within the 
Ways and Means Committee's jurisdiction how they are progress- 
ing toward the Y2K challenge and what confidence we should have 
that the affected taxpayers and beneficiaries will be properly 
served in the next century. We are interested in the risks that the 
agencies have identified and the actions that they are taking to 
manage those risks as well as their plans for contingencies. 

We will also be hearing from private sector representatives about 
their efforts to manage their risks inherent in theY2K effort. Many 
of these organizations are data trading partners with our agencies 
and will be affected in a major way by the success or failure of the 
Federal effort. Finally, we will hear from representatives of the 
U.S. General Accounting Office about the Y2K vulnerabilities that 
remain in our agencies' programs and what actions are being taken 
to fix these systems in time to avoid catastrophic consequences. 

This is not solely a U.S. problem, it is a global one. Edward 
Yardeni, a noted economist from Deutsche Morgan Grenfell, has 
studied the problem— who as studied the problem, rates the odds 
that it will trigger a deep worldwide recession at 60 percent. While 
some consider this to be a pessimistic view, and I consider it to be 
a pessimistic view, the current focus on Asian financial instability 
and Eurodollar conversion may divert resources from being com- 
mitted to properly preparing for the year 2000 and this could have 
serious economic consequences. There will always be pockets of 
those in the private sector who did not take the actions needed to 
look out for their business and economic interests. Flowever, at the 
very least, it is our job to see that the public sector systems are 
ready with sufficient capacity to the economic needs of the private 
sector. We cannot afford to fail the millions of Americans who are 
relying on the public sector effort to be successful. 

And, so, today, we bring our more comprehensive oversight effort 
at reviewing those systems under our jurisdiction, and I welcome 
all the witnesses here today. I know this is going to take a good 
deal of time, but I think the interrelationship of the different pan- 
els is important to our understanding where we are in meeting the 
challenge of this problem. 

[The opening statement follows:] 

statement of Hon. Nancy L. J ohnson, a Representative in Congress from 
the State of Connecticut 

Good morning. Hardly a day goes by when we don't read a news paper article or 
see a story on TV about the year 2000 computer problem. A problem with its own 
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catchy acronym— 'Y2K"— that is quickly becoming a household term. Some have 
suggested that we are headed towards a "millennium meltdown" with a high prob- 
ability of a nationwide recession. Others have suggested it merely will be ann^ing. 

Changing the date field to distinguish between J anuary 1, 2000 and 1900 is not 
technically difficult. What is challenging, however, is finding the date fields in old 
undocumented computer programs and searching for date-dependent computer chips 
embedded in non-computer system items such as elevators and security systems. 
Each must be modified in order to function in the year 2000. The enormity of the 
problem becomes evident when you consider that these modifications must be made 
by every organization, public and private, on every computer system that considers 
dates in some manner. Then, all those modified systems must be integrated and 
tested to make certain they produce consistently accurate results. 

J ust in the Federal agencies alone, we have more than 7,850 mission critical sys- 
tems which must be able to function in the year 2000. Of these mission critical sys- 
tems, 1,126 are within this Committee's jurisdiction— and nearly all must be able 
to exchange information with each other, state and local systems, and private sector 
systems— to be able to make proper calculations for millions of Social Security re- 
cipients, Medicare beneficiaries and taxpayers. These systems must be able to keep 
accurate beneficiary records and taxpayer accounts. 

What has become evident to me is that this is a major management problem with 
a technical component. The Federal government is not known for its ability to man- 
age well, particularly its computer system modernization efforts. Yet millions of 
beneficiaries and taxpayers find themselves relying on these managers to rise to the 
year 2000 challenge. While it is hard to have complete confidence in agencies that 
historically have been unable to successfully deliver computer systems that function 
properly on schedule, J anuary 1, 2000 is a finite date that cannot be missed— with- 
out effecting millions of Americans. It is our job, in Congress, to see that bene- 
ficiaries and taxpayers are protected against risks that may result in computer sys- 
tem errors from government systems that are not year 2000 compliant. 

We are here to learn today from the major agencies within the Ways and Means 
Committee jurisdiction how they are progressing towards meeting the Y2K chal- 
lenge and what confidence we should have that the effected taxpayers and bene- 
ficiaries will be properly served into the next century. We are interested in the risks 
that the agencies have identified and the actions that they are taking to manage 
those risks as well as their plans for contingencies. 

We also will be hearing from private sector representatives about their efforts to 
manage risks inherent in the Y2K effort. Many of these organizations are data trad- 
ing partners with our agencies, and will be affected in a major way by the success 
or failure of the Federal effort. Finally, we will hear from r^resentatives from the 
U.S. General Accounting Office about the Y2K vulnerabilities that remain in our 
agencies’ programs and what actions need to be taken to fix these systems in time 
to avoid catastrophic consequences. 

This is not solely a U.S. problem; it is a global one. Edward Yardeni, a noted econ- 
omist from Deutsche Morgan Grenfell, who has studied the problem, rates the odds 
that it will trigger a deep world-wide recession at 60 percent. While some may con- 
sider this to be a pessimistic view, the current focus on Asian financial instability 
and Eurodollar conversion may prevent others from committing the necessary re- 
sources to properly prepare for the year 2000 and could have serious economic con- 
sequences. There will always be pockets of those in the private sector who do not 
take the actions needed to look out for their business or economic interests. Flow- 
ever, at the very least, it is our job to see that the public sector systems are ready 
with sufficient capacity to the economic needs of the private sector. We cannot afford 
to fail the millions of Americans win are relying on the public sector effort being 
successful. 


Chairman J ohnson of Connecticut. And at this point, I'd like to 
yield to my colleague, Mr. Coyne. 

Mr. Coyne. Thank you. Madam Chairman. 

Today, we will continue our review of the progress being made 
by departments and agencies within this Committee's jurisdiction 
to ensure a smooth computer system conversion process at the turn 
of the century. The year 2000 conversion process arises because 
many computer systems store dates using only the last two digits 
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for the year. For such computers, the year 2000 will be indistin- 
guishable from the year 1900. 

Correcting a year field is technically simple. However, the proc- 
ess of analyzing, correcting, testing, and integrating computer sys- 
tems is a very complex and time-consuming task. The challenges 
facing the Federal Government are very similar to those facing the 
State and local governments, the private sector, foreign countries, 
and international organizations. While each entity needs to be pre- 
pared for the year 2000 internally, it is also critical that its data 
exchanges be year 2000 compliant in order to avoid systems break- 
downs. The magnitude of the situation is daunting. Recent esti- 
mates indicate U.S. business are likely to spend between $30 and 
$50 billion addressing year 2000 changes, and that worldwide con- 
version costs could be between $300 and $600 billion. 

It is timely that we review the overall year 2000 activities of the 
Department of Treasury, and Health and Human Services, as well 
as the progress being made in the Internal Revenue Service, U.S. 
Customs Service, the Health Care Financing Administration, and 
the Social Security Administration. 

By and large, it appears that these Federal agencies are on track 
and are taking the year 2000 conversion process seriously. None- 
theless, as the General Accounting Office reported last week, and 
I quote: 'The public continues to face a high risk that critical serv- 
ices provided by the Federal Government and the private sector 
could be severely disrupted by the year 2000 computing crisis." 

In my opinion, the Subcommittee needs to ask the witnesses be- 
fore us today the same fundamental questions being asked by the 
President's Council on the Year 2000 Conversion, and that is, what 
are your major risks? What are the most significant obstacles to re- 
moving those risks? And what contingency plans are appropriate in 
light of that analysis? From an Oversight Subcommittee stand- 
point, I would add two questions relating particularly to the De- 
partment of T reasury and the I RS, do you have the resources need- 
ed to get the job done? And, at the end of the day, is the conversion 
process going to be a success? 

I look forward to exploring these issues with each of the wit- 
nesses, and I thank the Subcommittee Chairman, Mrs. j ohnson, for 
scheduling today's hearing. 

Thank you. 

[The opening statements follow:] 

statement of Hon. William J . Coyne, a Representative in Congress from the 

State of Pennsylvania 

Today, the Ways and Means Oversight Subcommittee wiii continue its review of 
progress being made, by departments and agencies in the Committee's jurisdiction, 
to insure a smooth computer system conversion process at the turn of the Century. 

The year 2000 conversion process arises because computer systems store dates 
using oniy the iast two digits for the year. For such computers, the year 2000 wiii 
be indistinguishabie from the year 1900. Correcting a year field is technically sim- 
ple. Flowever, the process of analyzing, correcting, testing, and integrating computer 
systems is a very complex and time-consuming task. 

The challenges facing the Federal Government are very similar to those facing 
state and local governments, the private sector, foreign countries, and international 
organizations. While each entity needs to be prepared for year 2000 internally, it 
also is critical that its data exchanges be year-2000-compliant in order to avoid sys- 
tems breakdowns. 

The magnitude of the situation is daunting. Recent estimates indicate that U.S. 
business are likely to spend between $30 and $50 billion addressing year 2000 
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changes, and that worldwide conversion costs could be between $300 and $600 bil- 
lion. 

It is timely that we review the overall year 2000 activities at the Departments 
of the Treasury and Health and Human Services, as well as progress being made 
at the Internal Revenue Service, the U.S. Customs Service, the Health Care Financ- 
ing Administration, and the Social Security Administration. By in large, it appears 
that these Federal departments and agencies are on track and taking the year 2000 
conversion process seriously. 

Nonetheless, as the U.S. General Accounting Office reported last week, "the public 
continues to face a high risk that critical services provided by the Federal Govern- 
ment and the private sector could be severely disrupted by the year 2000 computing 
crisis." 

In my opinion, the Subcommittee needs to ask the witnesses before us today, the 
same fundamental questions being asked by the "President's Council on the Year 
2000 Conversion." They are: 

• What are your major risks? 

• What are the most significant obstacles to removing those risks? and, 

• What contingency plans are appropriate in light of that analysis? 

From an Oversight Subcommittee standpoint, I would add two questions relating 
particularly to the Department of the Treasury and the I RS: 

• Do you have the resources needed to get the job done? and, 

• At the end of the day, is the conversion process going to be a success? 

I look forward to exploring these issues with each of the witnesses. I also want 
to thank Subcommittee Chairwoman J ohnson for scheduling this important hearing. 


Statement of Hon. J im Ramstad, a Representative in Congress from the 

State of Minnesota 

Madam Chairman, thank you for convening this important hearing on the Year 
2000 (Y2K) Problem. 

The possible malfunction of the government's computer systems is a critical issue 
for all Americans. The magnitude of this potential problem is illustrated by the 
number of representatives we have here today. All of our constituents have a vested 
interest in how the different aspects of their government are working to avoid a po- 
tential disaster. 

Some progress on solving the Year 2000 problem has been made. But asj anuary 
1, 2000 rapidly approaches it is up to Congress to enure that we are doing our part 
to help solve this problem. We need to ensure that the people we represent are not 
left without the health care and financial services upon which they depend. 

I am pleased that this hearing will allow us to examine what the different agen- 
cies under our jurisdiction are doing to be prepare for the year 2000 and how they 
are coordinating their efforts with the organizations in the private sector with which 
they work. 

Again, Madam Chairman, thank you for your own leadership in looking into the 
Year 2000 computer problem by holding this critical hearing. 


Chairman J ohnson of Connecticut. Thank you very much. Our 
first witness is going to be Mr. Rossotti, who has to ieave, so after 
his— after your statement, Commissioner, then i'ii ask the mem- 
bers of the panei if they have any questions, if there's time enough 
for you. And, then you'ii ieave and we'ii hear from the rest of the 
panei. Thank you. 

Mr. Rossotti. 

STATEMENT OF HON. CHARLES O. ROSSOTTI, COMMISSIONER, 
INTERNAL REVENUE SERVICE 

Mr. Rossotti. Thank you, and i appreciate that very much. 
Madam Chairman. And thank you for the opportunity to discuss 
the iRS' century date change program, i have just a brief orai 
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statement and I'd ask that my full testimony be included in the 
record. 

Chairman J ohnson of Connecticut. So ordered. 

Mr. Rossotti. Madam Chairman, the Y2K conversion, in con- 
junction with our preparations for the next filing season, are, with- 
out a doubt, our highest technology priorities. And I stress that we 
are very aggressively managing this almost $1 billion program. We 
are trying to identify risks and take timely action to ensure that 
the overriding goal of continuous service is fulfilled. I also want to 
mention, however, that on a program of this kind we have to often 
adjust deadlines and timetables as we identify new risks and new 
issues. So Y2K remains, not only a high priority, but a high risk 
that will require a continued intense focus by all of us to succeed. 

I think that a big part of our challenge at the IRS is not only 
our computer programs, our applications programs which is what 
most people think of in terms of fixing the date field, but the enor- 
mous inventory of other kinds of technology, hardware, and soft- 
ware, and telecommunications that we have in the IRS. This in- 
cludes about 80 mainframe computers, 1,400 minicomputers, over 
100,000 personal computers, and a massive set of tdecommuni- 
cations networks that have over 100,000 components in them. 

Because of the size of this inventory, as well as its age, frag- 
mentation, and a wide variety of different vendor products associ- 
ated with the infrastructure, the success of the overall Y2K pro- 
gram requires a strong central management and oversight of this 
whole combined program. In addition, we have to work with other 
outside parties such as the General Services Administration, who 
ensure that our buildings and facilities, including leased facilities, 
have operational elevators, physical security, equipment, and so 
forth after the century date change. 

I have personally placed an extremely high priority on this Y2K 
project from literally the first week that I took office. One of the 
first things that I ciid was to organize an executive steering com- 
mittee, which I chair myself, and it has representatives of all the 
key decisionmakers within the IRS, as well as the Treasury De- 
partment and even our National Treasury Employees Union. Re- 
cently, a representative from the GAO has been sitting in these 
meetings with us. In between these meetings, which are very im- 
portant because they tend to "tee-up" exactly the decisions that we 
need to make, I also meet quite regularly with the Acting Chief In- 
formation Officer, and other executives to deal with specific issues 
and to monitor risks. We also have a variety of independent assess- 
ments going on from outside organizations, such as, consulting 
firms Booz-Allen and Hamilton, and Andersen Consulting, as well 
as active use of our internal audit staff which has actually very 
good technology auditing capabilities within the IRS. And, of 
course, the GAO assessments. 

Madam Chairman, in my testimony, I want to give a balanced 
assessment of the situation that we're in but I don't want to mini- 
mize what is obviously a dangerous and risky situation. Let me de- 
scribe some of the risK areas, and some of the things that we're try- 
ing to do about it. In addition to the conversion probe of the cen- 
tury date change and all the infrastructure, we have the unique 
situation— maybe it's not unique— but we have the situation at the 
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I RS that at this very time, this calendar year, we also have to im- 
plement about 750 to 800 tax law changes that stem from the 1997 
Taxpayer Relief Act. Most of them are effective this tax year. These 
changes are being made to the same computer programs, by the 
same programmers and are being managed by the same people 
working on the century date change. So we are managing that as 
an integrated program with our century date change. 

In order to try to mitigate that risk, one of the things that we 
did, that I did, actually, toward the end of last year was to try to 
accelerate, by at least several months, the normal schedule for 
doing these annual tax law changes so we would buy some elapsed 
time to make these changes. Nevertheless, even with that acceler- 
ated schedule, as we speak today in early May, none of these 750 
to 800 changes has actually been implemented yet. In fact, some 
of them we met on this week and are not yet completely defined. 
So we have a significant job to complete that along with the cen- 
tury date change application programming this year. 

Another important thing that we are attempting to turn our at- 
tention to right now, it has been underway for some time, but we're 
starting to focus more attention on it, is the planning for 1999 for 
our integrated end-to-end integration test. We will have to do a 
complete test of all these different pieces fitting together, the appli- 
cations programs, the different kinds of computers, the software, 
and the telecommunications network. We will have to do a large- 
scale, integrated end-to-end for this next year. 

In reflecting on this, I realize that this is probably going to be 
the largest single test of a business-type computer system ever, 
anywhere. There is no precedent that I'm aware of for this kind of 
a test. Planning for this is something that we have already under- 
way and is going to be quite challenging. 

Of course, we also have not only ourselves to worry about, but 
external trading partners as, I believe, you and Mr. Coyne men- 
tioned in your opening statements. We have been also working on 
that. We have had an independent assessment with the aid of an 
outside firm looking at our 13 major trading partners, including 
the Social Security Administration, the Financial Management 
Service, and, of course, the key providers of our electronic pay- 
ments, and our third-party information returns. And we have a 
program in place to work together and to identify what risks we 
have with those external trading partners. 

Finally, I want to mention, as GAO has pointed out, that we 
need to also spend some of our time trying to work on contingency 
plans where we can, in those cases where there might not be full 
success in converting some of our technology. We're spending some 
of our effort on doing this kind of contingency planning. We're try- 
ing to focus our efforts, because we have limited management re- 
sources, on those areas where there would obviously be a high busi- 
ness impact, where there's a higher risk than other places where 
the schedule might slip. And also, of course, where there is a prac- 
tical contingency plan that we can develop which doesn't apply in 
all cases. There are some places where there really is no contin- 
gency plan of any practical kind for the I RS. So we are working on 
that as well. 
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I guess I would just conclude by saying that this is a massive 
challenge. It r^uires a great deal of time and effort, which dis- 
places other things that we would like to do. We will gain some 
benefit from this because I think the learning experience of con- 
ducting and managing this kind of a project in a place like the I RS 
will have some residual benefit in ha ping us to improve, certainly 
our inventory of technology, but also our management practices 
and our system life cycle. I think if you want to conclude where we 
are, I think that we are making progress. We are managing it ag- 
gressively, but clearly there are substantial risks remaining in spe- 
cific technical areas, such as our tier 2 hardware and software, 
which is a complex area for us; our telecommunications network; 
and this large end-to-end integration test that we're going to have 
to do next year. 

The final point is that I would just want to point out to the Com- 
mittee, as we're discussing with members of the staff and Members 
over on the Senate side, that some of the provisions in the I RS re- 
structuring bill that came out of the Senate Finance Committee, we 
believe need to have later effective dates than were in their draft 
in order for us to make this whole thing workable. This is not a 
matter of policy or desirability, it is just a feasibility question of 
how we will be able to accommodate some of these changes in light 
of all the other demands that we have on us. And, obviously, we 
have to give priority to maintaining uninterrupted service with the 
technology that we have. 

So, let me just conclude there. Madam Chairman, and I would 
be happy to answer questions. 

[The prepared statement follows:] 

statement of Hon. Charles O. Rossotti, Commissioner, Internal Revenue 

Service 

Madame Chairman and Distinguished Members of the Subcommittee: 

Thank you for the opportunity to discuss the Internai Revenue Service's (IRS') 
progress concerning the Century Date Conversion project. 

Program Scope and Status 

The IRS is a huge enterprise, employing more than 100,000 individuals in service 
centers, regional offices, district offices and posts of duty across the United States 
and around the world. A $1.7 trillion financial services organization, the IRS de- 
pends on its automated systems to process tax returns, issue refunds, deposit pay- 
ments, and provide employee access to timely and accurate taxpayer account data. 

The IRS information technology organization faces major challenges associated 
with new tax law changes that r^uire extensive reprogramming of legacy systems 
each filing season. For example, the Taxpayer Relief Act of 1997 requires the IRS 
to make more than 750 legacy systems changes for the 1999 filing season. 

I n addition, the scope and short time frames associated with our massive century 
date conversion project present tremendous challenges to our technical management 
of IRS systems. If not corrected, most existing application systems are programmed 
to display 00 in the year fields, and after J anuary 1, 2000, would incorrectly use 
1900 for the year in date-based calculations. Failure to identify, renovate and test 
each of these system calculations could result in catastrophic disruption to tax- 
payers and the government. For example, millions of erroneous tax notices, refunds, 
bills, taxpayer account adjustments, accounting transactions and financial reporting 
errors could be generated. Clearly, the IRS' role in collecting revenue supporting 95 
percent of the federal government's operations could be jeopardized if the Century 
Date program is not completed in a timely fashion. 

Adding to the challenge is our largely non-Year 2000 compliant technical infra- 
structure which includes more than 80 mainframes, 1,400 minicomputers, 130,000 
personal computers and massive telecommunications networks comprised of more 
than 100,000 components. Because of the number, age, fragmentation, and variety 



12 


of products associated with this infrastructure, successfui impiementation of these 
aspects of our Year 2000 program require strong centrai management and oversight. 
Pians for upgrading and/or repiacing these components must be integrated into the 
overaii program management pian, scheduie, and budget. Lastiy, to ensure century 
date compiiance, it is essentiai that the IRS continues to work with its iandiord, the 
Generai Services Administration, to ensure that IRS buildings and leased facilities 
and equipment, including elevators and physical security systems, are upgraded or 
replaced. 

Major elements of the IRS Year 2000 program are as follows: 

• Application Systems Conversion 

The IRS currently supports 127 mission-critical application systems comprising 
85,000 modules and approximately 50 million lines of code. IRS has five phases for 
code conversion, each six months long, and has completed three phases to date. As 
of April 24, 1998, the IRS has renovated 83 of its 127 mission-critical systems and 
tested 62. Fifty-nine of these systems were placed back into production. These sys- 
tems are working effectively and contributed to a successful filing season. We are 
on schedule to complete the systems conversion by J anuary 1999. 

• Tier II (minicomputer) and Tier III (personal computer) Platforms 

Tier II and Tier III computers and their associated systems software (operating 
systems, data bases, etc.) require replacement or upgrades. Century date compliance 
for more than 1,400 minicomputers and 130,000 personal computers largely depends 
on obtaining vendor upgrades; many are only now being made available in the mar- 
ket place. We are currently evaluating and testing these components to ensure they 
are compliant. This year we will replace/upgrade over 35,000 personal computers; 
over 100 minicomputers will be replaced and several hundred more will be up- 
graded. 

• Telecommunications 

The critical IRS network backbone is supported through the Treasury Commu- 
nications System (TCS) contract. A network component inventory was received from 
the contractor. We are reviewing and validating these data as well as the contrac- 
tor's site specific plans to convert the network. Given the need to upgrade or replace 
thousands of components within the TCS network, as well as additional IRS propri- 
etary networks which themselves comprise nearly 30,000 components, the network 
conversion represents a significant challenge. Int^rated project management teams 
were formed with the TCS contractor, and we have engaged the services of other 
contractors to assist us in completing this critical effort. 

• External Trading Partners 

The IRS is but one of many data dependent public (e.g.. Financial Management 
Service and Social Security Administration) and private sector organizations (e.g., 
banks and financial institutions) which both send and receive data from one an- 
other. At this time, IRS efforts are on schedule to validate the accuracy of both in- 
coming century date compliant data from a variety of sources and outgoing IRS cen- 
tury date compliant data to its trading partners. Over 60 percent of our trading 
partner files have been made compliant, and the remainder are scheduled for con- 
version byj anuary 1999. 

• Non-I nformati on Technology 

A critical component of the non-information technology (non-IT) aspect of the pro- 
gram depends on the General Services Administration which is performing an in- 
ventory of its facilities. In addition, we are working with a contractor to complete 
an assessment of IRS-owned facilities and personal property. These inventories will 
be completed shortly, and cost and schedule information will be available in early 
summer. 

• Testing 

Even prior to identifying the Century Date Conversion testing requirements, the 
Information Systems Product Assurance Division, responsible for Systems Accept- 
ance Testing, lacked sufficient resources to fulfill its mission. In 1996, the Division 
was able to test only 20 percent of the systems placed into production. While some 
progress has been made, the Division's current testing operation covers only 30 per- 
cent of the agency's production systems. 

Given the critical need to undertake a comprehensive end-to-end Century Date 
systems test, we will dedicate significantly more IRS and contractor resources to 
these testing efforts. Internal IRS hiring is underway, and detailed integration test 
plans are currently being developed in conjunction with contractors who will support 
this effort. 

• Mainframe Consolidation 

Instead of investing more than $250 million to upgrade the agency's computer 
mainframes to ensure century date compliance, the IRS proposed and received Con- 
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gressional approval for a mainframe consolidation program that consolidates 67 
mainframes currently located at 10 service centers into 12 mainframes located at 
two computing centers. These mainframes support I RS returns processing, customer 
service and compliance operations. The consolidation program will provide for both 
century date compliance and savings of more than $250 million over 10 years. In 
addition, this initiative will position the IRS to take significant steps forward in its 
long-term information technology modernization efforts. The rollout of a century 
date compliant network of approximately 16,000 personal computers and related 
equipment will standardize a major component of the IRS telecommunications infra- 
structure, thus improving the ability to communicate among systems. In an effort 
to mitigate risks and incorporate additional business requirements for disaster re- 
covery and increased systems capacity based on new customer service needs, we are 
extending the time frame for completing the mainframe consolidation effort; how- 
ever, the components of the project required to achieve Year 2000 compliance are 
currently on schedule and will be completed by December 1998. 

• Int^rated Submissions and Remittance Processing System 

Integrated Submissions and Remittance Processing (ISRP) replaces the anti- 
quated Distributed Input System (DIS) and Remittance Processing System (RPS) 
which form the core of the tax processing input pipeline that processes more than 
200 million tax returns and accounts for tax revenues of over $1.5 trillion. ISRP is 
currently in pilot status at the Austin Service Center and is on schedule to be fully 
implemented in all 10 service centers for the 1999 filing season. As of April 18, 
1998, ISRP has processed approximately two million tax returns and $1.3 billion in 
payments. 


Mitigating Risk 

Without exception, the Century Date Conversion is the Service's highest tech- 
nology priority. While the IRS assigned its most senior and qualified management 
to this program prior to my appointment as Commissioner, I reinforced the priority 
of this project by organizing and chairing a monthly Executive Steering Committee 
with representatives from Treasury, IRS, the General Accounting Office and the Na- 
tional Treasury Employees Union. As part of this process, I am personally monitor- 
ing the status of all Year 2000 activities and critical components. (See attached 
project overview for current status assessment.) I also meet on a regular basis with 
IRS' Acting Chief Information Officer and other top executives to obtain individual 
project status updates, monitor key risks, and make sure that necessary actions are 
being taken. In addition, recognizing the need to validate that we are doing every- 
thing we can to ensure that IRS is Year 2000 compliant, we initiated continuous 
independent assessments by organizations such as Booz-Allen & Hamilton, Inc. and 
Andersen Consulting, and continued Internal Audit and GAO assessments of our 
Year 2000 program. 

I can assure you that this effort has top-level management commitment: however, 

I don't want to minimize the risks associated with this effort and the need to de- 
velop the foil owing strategies: 

• Planning and Implementing an Integrated Century Date Conversion and 1999 
Filing Season Strategy 

Considering the extent of the Taxpayer Relief Act systems changes that require 
reprogramming of the same legacy systems that must be made century date compli- 
ant by J anuary 1999, it is essential to develop and implement an integrated Cen- 
tury Date/1999 Filing Season Plan. To mitigate risk, the IRS accelerated by several 
months the process for identifying the filing season related systems changes that 
would be incorporated into the integrated plan. 

• Contingency Planning 

Given the scope of the IRS program and its critical importance to both the na- 
tion's economy and its taxpayers, it is imperative that the Service's mission-critical 
systems continue to function properly in the new millennium. While the IRS has 
made substantial progress, the risks are still significant. Accordingly, the IRS must 
develop contingency plans to manage any adverse impacts of a less-than-fully suc- 
cessful century date program. These plans must address the needs of the IRS, as 
well as those of our data exchange partners. We intend to concentrate on those 
areas that have high business impact, significant Year 2000 complexity, and may 
not be completed on time or successfully. This will allow us to work on aspects that 
have the greatest risk, while leveraging the majority of limited resources on Year 
2000 conversion and testing. 
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Budget 

Projected FY 1998 cost estimates are $454 million, which includes: 

• $ 234.3 million for Year 2000 work under the Century Date Change Project Of- 
fice ($170 million appropriated: remaining covered through reprogramming): 

• $ 52.4 million for the Integrated Submission and Remittance Processing Sys- 
tem: and 

• $ 167.3 million for the Service Center Mainframe Consolidation (SCMC) which 
also includes funding for relocation/retraining and project staff. 

The IRS Century Date Change Project Office currently has specific budget re- 
quests totaling well over $170 million for fiscal year 1998. The $170 million only 
includes a small amount for non-IT conversion (the initial study) and additional 
funds are needed in this area as well as for Telecommunications, Tier II and Tier 
III hardware and commercial-off-the-shelf software, and Applications Conversion/ 
Testing for non-CIO owned systems. In addition, funding for a Fluman Resources 
Retention Allowance Strategy for key IS resources is essential to successful comple- 
tion of Year 2000 activities. Both Flouseand Senate Appropriations Subcommittees 
have approved the use of prior year inter-appropriation transfer authority to move 
unobligated balances from IRS' non-information Systems accounts for fiscal years 
1993, 1994, 1996, and 1997 to cover approximately $50 million of these additional 
Year 2000 requirements. The IRS is reviewing its current year resources to identify 
funds to cover the balance of these additional needs. 

IRS' FY 1999 cost estimate for Century Date Change Project Office Year 2000 
Project expenditures was $140 million, of which $50 million was held as a contin- 
gency until the IRS was able to complete its analysis of specific requirements. Since 
the budget was submitted, specific uses for $38.6 million of the $50 million contin- 
gency have been identified. The needs consist of: Non-Information Technology con- 
version, Tier III Flardware, Program Management, and the Fluman Resource Reten- 
tion Allowance. The contingency is thus reduced from $50 million to $11.4 million. 
Total FY 1999 costs for Year 2000 Project Expenditures may increase as additional 
needs are identified. 

Attached is a chart of estimated Y2K costs for FY 1997 through 2001. 

Opportunities 

While the primary goal is to timely complete the century date conversion, the I RS 
plans to leverage a variety of opportunities stemming from the project: 

• Eliminate Duplicate Applications 

From an inventory of an estimated 20,000 computer applications, we asked busi- 
ness owners to eliminate duplicate applications and establish the "best in breed" as 
a national standard application. The IRS has already retired 3,000 business- 
supported applications, and expects to retire approximately 3,500 additional pro- 
gram components. Looking ahead, IRS will limit the growth of future applications 
to better manage its Information Technology investments. 

• Create, within IS, a project planning and management environment. 

Century Date conversion is a massive project management challenge which re- 
quires the thoughtful development and faithful execution of a rigorous plan. We do 
not intend to walk away from the lessons learned and project management experi- 
ence gained from this effort. We will use these tools and expertise in adopting sys- 
tems life cycle best practices, policies and procedures for future information tech- 
nology investments. 


Conclusion 

In conclusion, the Year 2000 effort at the IRS, a $1 billion project, is one of the 
federal government's most formidable challenges. Although we are making sus- 
tained progress and are on schedule, risks remain in specific technical areas such 
as Tiers II and III hardware. Telecommunications, End-to-End Integration Testing 
and non-information Technology equipment. Because of its many stakeholders and 
interfaces, the IRS' Year 2000 program is highly complex. The IRS is working with 
its vendors to obtain Year 2000 compliant versions of their products. In addition, 
an independent risk assessment was conducted of IRS' major trading partners' Year 
2000 conversi on efforts (e.g.. Social Security Administration, Financial Management 
Service, as well as key providers of electronic payments, returns and third party 
documents) to identify problems and work through solutions. Because the risks are 
so significant, the IRS is developing contingency plans to manage any adverse im- 
pacts of a less than successful Century Date Program. 

Finally, the Administration has serious concerns with provisions of the IRS re- 
structuring legislation that require changes to IRS computer systems in 1998 and 
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1999. Mandating these changes according to the scheduie currentiy in the biii wouid 
make it virtuaiiy impossibie for the IRS to ensure that its computer systems are 
Year 2000 compliant by J anuary 1, 2000, and would create a genuine risk of a cata- 
strophic failure of the Nation’s tax collection system in the year 2000. Both Sec- 
retary Rubin and I have written the Senate Finance Committee warning them of 
this risk and recommending that the effective dates be modified in accordance with 
the schedule set forth in my April 23, 1998 letter. 



VIM* 







16 



Chairman Johnson of Connecticut. Thank you, Commissioner. 
You mentioned a couple of different times in your testimony that 
your, that dates were being adjusted. 

Mr. Rossotti. Yes. 

Chairman J ohnson of Connecticut. At one point you had hoped 
to complete most of the work by J anuary 1999 in order to be in a 
better position to test and to do the kind of end-to-end integration 
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testing that is necessary. What has happened to that J anuary 
date? 

Mr. Rossotti. Well, the J anuary date is still the target date for 
all the critical, mission-critical things that we have to be able to 
complete in time to have this end-to-end test. But, there are some 
things that we can delay. For example, our mainframe consolida- 
tion project has also the objective of cost savings and bringing all 
the computers into two computing centers, there are some parts of 
that where we don't have to absolutely have to do the consolidation 
effort in 1998 because we do have the ability to upgrade some of 
the computers that are out in the service centers. So we're going 
to do that, we're going to upgrade, as one of the contingency plans 
I mentioned, the mainframes that are out in the service centers 
that will allow us to have more time to do the consolidation with- 
out impacting on our ability to do the filing season in 1999 and the 
integration test later on. That's an example of one of the kinds of 
dates. And that's a pretty big one because that's a very major part 
of the project and it's also a large consumer of management time. 

In addition, there are other things that we adjust. For example, 
as a result of an internal audit project which I requested, which did 
a sample testing— did a test or a sample of some of the programs 
that have been converted. We found that there were some proce- 
dures that needed to be adjusted but there were also some certain 
kinds of errors that were detected that we had not been, I think, 
finding and fixing ad^uately enough. So we've added another step 
in there that we're going to do this summer to do a complete addi- 
tional kind of test at the component level of the inventory of appli- 
cation programs. Those are the kinds of things I'm talking about 
where we're adjusting dates and adjusting programs as we get new 
information. 

Chairman J ohnson of Connecticut. In your earlier discussions, 
you were very high on at least succeeding and completing one of 
the consolidation centers 

Mr. Rossotti. Yes. 

Chairman J ohnson of Connecticut. It sounds to me like you're 
probably deferring that effort now? 

Mr. Rossotti. No, we're not deferring the whole effort. We're 
working very hard on it. That whole mainframe consolidation has 
a number of different pieces to it. The two pieces that are abso- 
lutely critical for Y2K, because there's no alternative, are what's 
called the Communications Replacement System, and the replace- 
ment of some of the desktop top terminals. Those are, within a 
small margin, reasonably on schedule. The piece that involves actu- 
ally taking all the mainframes out of the 10 service centers and 
bringing them in is the part where we have more flexibility with 
respect to Y2K. What we've done is we have one of those service 
centers that's in Memphis, converted and running on a test basis. 

The second one is Kansas City, that's targeted for, I think, early 
summer. And what we're going to do in the Kansas City one is 
really the critical one in terms of testing how well the process is 
going to work. We're going to see how well that works and do some 
additional testing before we finalize the other schedule. Right now, 
we think the best estimate is that we can do Memphis and Kansas 
City plus two additional ones this year which would leave six for 
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next year. But those other six, or even eight if we had to, can be 
upgraded in place and we are planning as contingency plan to do 
that. So, I think, we've got the bases covered on that particular 
program in terms of Y2K. 

Chairman J ohnson of Connecticut. Thank you. Commissioner. 

Mr. Coyne. 

Mr. Coyne. Thank you. Madam Chairman. Commissioner, you 
indicated that you and Secretary Rubin had written a letter to the 
Senate Finance Committee. I wonder if we could have a copy of 
that letter? 

Mr. Rossotti. Sure. 

Mr. Coyne. For the record. 

Mr. Rossotti. We'll get that for you. 

[The following was subsequently received:] 

Department of the Treasury 

Internal Revenue Service 

March 31, 1998 


Honorable William V. Roth,J r. 

Chairman 

Committee on Finance 
United States Senate 
Washington, D.C. 20510 

Dear Mr. Chairman: 

I am writing to provide the Senate Finance Committee information about provi- 
sions under consideration as pail of the IRS restructuring bill which, in order to im- 
plement, will r^uire charges in IRS computer information systems. 

As is noted in one of the provisions of the restructuring bill, it is essential that 
the work needed to make the IRS computer systems comply with the Century Date 
Change be given priority. If these changes are not made and tested successfully, 
computer systems on which the IRS directly depends for accepting and processing 
tax returns and tax payments will cease to function after December 31, 1999. in 
order to accomplish this change, a massive effort is underway now and will continue 
through J anuary 2000. This project, one of the largest information systems chal- 
lenges in the country today, is estimated to cost approximately $850 million through 
FY 1999 and requires updating and testing of about 75,000 computer applications 
programs, 1400 minicomputers, over 100,000 desktop computers, over 80 mainframe 
computers and data communications networks comprising more than 50,000 individ- 
ual product components. In addition, the data entry system that processes most of 
the tax returns must be replaced. 

Most of the work to repair or replace these Individual components must be done 
prior to the tax season that begins in J anuary 1999, and thus is at its peak during 
calendar 1998. During this peak period, the IRS must also make the changes nec- 
essary to implement the provisions of the Taxpayer Relief Act of 1997 which are ef- 
fective in tax year 1998. These changes are still being defined in detail but are cur- 
rently estimated to require about 800 discrete computer systems changes. 

The most critical systems to which these changes must be made are systems that 
were originally developed in the 1960’s, 1970's and 1980's, and many are written 
in old computer languages. A limited number of technical staff have sufficient famil- 
iarity with these programs to make changes to them. Furthermore, the IRS suffered 
attrition of 8% of this staff during FY 97, which attrition has continued at the same 
or higher rate until recently. In part, this attrition reflected the very tight market 
for technical professionals as well as a perceived lack of future opportunities at the 
IRS. 

This extraordinary situation has required the I RS to commit every available tech- 
nical and technical management resource to these critical priorities and to defer 
most other requests for systems changes at least during calendar year 1998. 

For these reasons, it will not be feasible to make any significant additional 
changes to the I RS systems prior to the 1999 ailing season, pushing the start of all 
additional work to about the second quarter of calendar 1999. Furthermore during 
1999. a major amount of additional work will be required to perform the testing to 
ensure that all the repaired or replaced components work as expected prior toj anu- 
ary 1, 2000. Given the magnitude of the changes, it is likely that additional work 
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will be required to repair defects and problems that will be uncovered during the 
testing in the second half of 1999. Thus, while some capacity to make systems 
changes is projected to exist in 1999, there is considerable uncertainty about how 
much capacity will in fact be available even during calendar 1999. 

With this context in mind, we have attempted to identify the provisions in the 
restructuring bill that require significant changes to computer systems and estimate 
how much staff time would be needed to implement these changes. Based on this 
very preliminary analysis, we have prepared a list of recommended effective dates 
if these provisions are adopted. In all cases, we would strive to implement the provi- 
sions sooner if possible. In addition, two provisions entail both significant systems 
and policy issues. For these items, which are discussed first, we suggest an alter- 
native approach. 


Alternative approach 

1. Require that all IRS notices and correspondence contain a name and a tele- 
phone number of an IRS employee who the taxpayer may call. Also, to the extent 
practicable and where it is advantageous to the taxpayer, the IRS should assign one 
employee to handle a matter with respect to a taxpayer until that matter is re- 
solved. 

Concern: We agree with the objectives of this proposal, but are concerned because 
it would entail a total redesign of customer service systems, and would actually 
move the IRS away from the best practices found in the private sector. We do sup- 
port the proposal that the IRS should assign one employee to handle a matter with 
respect to the taxpayer where it is both practicable and where it is advantageous 
to the taxpayer. 

The proposal would affect the Masterfile, Int^rated Data Retrieval System 
(IDRS), and any system supported by IDRS (including AIMS and ACS). In addition, 
the proposal is likely to decrease the customer service we are trying to improve 
through our expansion of access by telephone to 7 days a week, 24 hours a day. The 
assignment of a particular employee for a taxpayer contact could actually increase 
the level of taxpayer frustration as the named employee may be on another phone 
call, working a different shift, or handling some other taxpayer matter when tax- 
payers call. In addition, consistent with private sector practices, we are currently 
installing a national call router designed to ensure that when a taxpayer calls with 
a question, the call can be routed to the next available customer service representa- 
tive for the fastest response possible. 

Proposal: Require that the IRS adopt best practices for customer service with re- 
gard to notices and correspondence, as exemplified by the private sector. Require 
that the IRS report to Congress on an annual basis on these private sector best 
practices, the comparable state of IRS activities, and the specific steps the IRS is 
taking to close any gap between its level and quality of service and that of the pri- 
vate sector. Furthermore, the IRS could be required to put employee names on indi- 
vidual correspondence it could require all employees to provide taxpayers with their 
names and employee ID numbers; and, finally, it could record, in the computer sys- 
tem, the ID number of the employee who takes any action on a taxpayer account. 

2. The proposal would suspend the accrual of penalties and interest after one 
year, if the IRS has not sent the taxpayer a notice of deficiency within the year fol- 
lowing the date which is the later of the original date of the return or the date on 
which the individual taxpayer timely filed the return. 

Concern: We agree with the objective of the proposal to encourage the IRS to pro- 
ceed expeditiously in any contact with taxpayers, however, our systems are cur- 
rently unable to accommodate some of the data requirements with the speed nec- 
essary to make this proposal workable. In addition, we are concerned that the pro- 
posal could have the perverse incentive of encouraging taxpayers to actually drag 
out their audit proceedings rather than work with the I RS to bring them to a speedy 
conclusion. Our administrative appeals process, which is designed to resolve cases 
without the taxpayer and the government incurring the cost and burden of a trial, 
could also become a vehicle for taxpayers to delay issuance of a deficiency notice. 

Proposal: Require the IRS to set as a goal the issuance of a notice of deficiency 
within one year of a timely filed return. Mandate that the IRS provide a report to 
the Congress on an annual basis that specifies: progress the IRS has made toward 
meeting this goal, measures the IRS has implemented to meet this goal, additional 
measures it proposes toward the same end, and any impediments or problems that 
hinder the I RS' ability to meet the goal. In addition, the proposal could reemphasize 
the requirement that the IRS abate interest during periods when there is a lapse 
in contact with the taxpayer because the I RS employee handling the case is unable 
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to proceed in a timely manner. The IRS could be required to provide information 
on the number of cases in which there is interest abatement each year in the report. 

Effective dates 

We propose the following effective dates for specific provisions. These dates are 
driven by the capacity of our information technology systems, not the impact of the 
policy. Some of these provisions would be fairly easy to implement, but in total and 
in conjunction with all the other demands on our information technology resources 
it is simply not feasible to implement them until the dates proposed. If the situation 
changes, we will strive to implement the provisions sooner. 

The effective date for many of these charges is J anuary 31, 2000. Given that all 
of these changes must be made compatible with the Century Date Change, we be- 
lieve we will need the month of January 2000 to ensure all the Century Date 
Charges are successful before implementing the provisions listed below. 

• Allow the taxpayers to designate deposits for each payroll period rather than 
using the first-in-first-out (FIFO) method that results in cascading penalties. 

—Effective immediately for taxpayers making the designation at time of deposit. 

— Effective] uly 31, 2000 for taxpayers making the designation after deceit. 

• Overhaul the innocent spouse relief requirements and replace with Propor- 
tionate liability, etc. 

—Effective date: July 31, 2000. The IRS has no way of administering propor- 
tionate liability with our current systems. This provision would require significant 
complex changes to cur systems and is likely to be cumbersome and error-prone for 
both taxpayers and the IRS, 

• Require each notice of penalty to include a computation of penalty. 

—Effective date: Notices issued more than 180 days after date of enactment 

• Develop procedures for alternative to written signature for electronic filing. 

—The IRS is already preparing a pilot project for filing season 1999. Subsequent 

roil out of alternatives to written signatures for electronic filing will depend an the 
success of the pilot. 

• Develop procedures for a return-free tax system for appropriate individuals. 

—This provision should be interpreted as a study of the requirements of a return- 

free tax system and the target segment of taxpayers. Actual implementation will be 
based on the findings and conclusions of the study. 

• I ncrease the i nterest rate on overpayments for non-corporate taxpayers from the 
federal short-term interest -F2%to-F3%. 

—Effective date: J uly 31, 1999. 

• Do not impose the failure to pay penalty while the taxpayer is in an installment 
agreement. 

—Effective date] anuary 31, 2000. 

• Require the IRS to provide notice of the taxpayer's rights (if the IRS requests 
an extension of the statute of limitations). Require Treasury I G to track. 

—Effective date: J anuary 31, 2000. 

• Require IRS to provide on each deficiency notice the date the IRS determines 
is the last day for the taxpayer to file a tax court opinion. A petition filed by the 
specified date would be deemed timely filed. 

—Effective date: notices mailed after December 31, 1998. 

• Require the Treasury IG to certify that the IRS notifies taxpayers of amount 
collected from a former spouse. 

—Effective date: J anuary 31, 2000, 

• R^uire the IRS to provide notice to the taxpayer 30 days (90 days in the case 
of life insurance) before the IRS liens, levies, or seizes a taxpayer's property. 

—Effective date: 30 days after date of enactment for seizures; J anuary 31, 2000 
for liens and levies. 

• Require the I RS to immediately release a)levy upon agreement that the amount 
is "currently not collectible." 

—Effective date: J anuary 31, 2000. 

• Waive the 10% addition to tax for early withdrawal from an IRA or other quali- 
fied plan if the IRS levies. 

—Effective date: J anuary 31, 2000, 

• The taxpayer would have 30 days to request a hearing with IRS Appeals. No 
collection activity (other than jeopardy situations) would be allowed until after the 
hearing. The taxpayer could raise any issue as to why collection should not be con- 
tinued, 

—Effective date: J anuary 31, 2000. 

• IRS to implement approval process for liens, levies, and seizures. 
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—Effective date: implement procedure manually 60 days after date of enactment; 
implement system for IG tracking and reporting] anuary 31, 2000. 

The following items were proposed in the Administration's FY 1999 Budget. In 
conjunction with the other proposals in this bill, they will also require significant 
systems changes: 

• Eliminate the interest rate differential on overlapping periods of interest on in- 
come tax overpayments and underpayments. 

• Prohibit the IRS from collecting a tax liability by levy if: (1) an offer- 
compromise is being processed; (2) within 30 days following rejection of an offer; and 
(3) during appeal of a rejection of an offer. 

• Suspend collection of a levy during refund suit. 

• Allow equitable tolling of the statute of limitations on filing a refund claim for 
the period of time a taxpayer is unable to manage his affairs due to a physical or 
mental disability that is expected to result in death or last more than 12 months. 
Tolling would not apply if someone was authorized to act on these taxpayers' behalf 
on financial affairs. 

• Ensure availability of installment agreements if the liability is $10,000 or less. 

Finally, we would attempt to immediately implement the cataloging of taxpayer 

complaints of employee misconduct and would stop any further designation of "ille- 
gal tax protesters." Flowever, there may be some systems issues with regard to these 
proposals that could delay certain changes until sometime in early 1999. 

I look forward to working with you, the Finance Committee, and the Congress as 
we strive to restructure the I nternal Revenue Service. 


Sincerely, 


Charles O. Rossotti 

Commissioner 


cc: Senator Daniel Patrick Moynihan, Ranking Minority Member 


Mr. Coyne. And also if you could discuss the major two or three 
taxpayer rights provisions that you say need a delayed effective 
date? 

Mr. Rossotti. I'll mention a few. I don't have the letter with me. 

I 'll mention a few that are at the top of my mind, but there's actu- 
ally more than a few that I'm afraid need some delayed dates, or 
actually some alternative ways of handling them. I mean, one ex- 
ample that I think is well intentioned in its objective is a provision 
that would require us to put the name of an individual employee 
on all notices that are sent to taxpayers. This is a really major 
problem because most of the time a notice is like a phone bill or 
something. It isn't associated with an individual employee and our 
whole strategy for improving customer service is to take advantage 
of all our resources across the country so that we can get a phone 
call through to the first available assister, first available customer 
representative. So that approach would be really a major problem 
in a number of ways. One is related to century date. The other is 
it really has to be rethought as to how we would do that one. I 
think that one is very problematical except for a small number of 
notices that are individually generated correspondence by individ- 
ual, for example, revenue agents. That part is fine. Within a rea- 
sonable timeframe we can do that, but on the larger volume of no- 
tices, it isn't going to work. Another one has to do with the pen- 
alties on installment agreements. This was one that clearly, you 
know, everybody seems to agree to make sense. But it requires 
some significant reprogramming to deal with the way the penalty 
revision is in the taxpayer rights provision, and, you know, this 
gets right at the heart of the kind of resource requirements that 
we have for the year 2000. 



22 


So, for example, on that one we requested, I believe, to put the 
effective date off. In most cases, what we've asked for is to put the 
effective dates off so that we can fold them into the work we're 
going to do in 1999 that would go into effect after the turn of the 
century in the year 2000 filing season. And that is an example of 
that one. There are a fairly long list of others. There are some oth- 
ers that the J oint Committee staff has come up with. Some are, I 
think, practical ways to deal with them in the short term that we 
agree with. 

So we're trying to work this issue and accommodate as many 
things as fast as we can. And I actually feel it's very unfortunate 
that we're in a situation where there are provisions that we all 
think, you know, are desirable and we're asking to put them off be- 
cause of this reason. But that is, in fact, the reality that we're in. 

Mr. Coyne. What are the departments, the IRS high-risk areas 
likely that are going to require a backup plan. For instance, would 
you issue refund checks annually? 

Mr. Rossotti. Well, the high-risk areas, I think, right now, the 
highest risk areas are the telecommunications network, what we 
call the tier 2, the middle-size minicomputers because they are in 
the IRS not very standardized and we have quite a bit of work to 
do on them. And I think more than anything is just the integration 
of all this into a comprehensive test plan. Those are the three most 
important. 

Now, we also have risks on the mainframe consolidation but I 
think that one we do have a contingency plan for the parts that 
are higher risk if we were implementing that contingency plan. I 
mean, if you look at what would be a contingency plan for issuing 
refunds, if you don't have your computer systems, frankly, I don't 
think you can issue 90 million refunds in any way without the com- 
puter systems working. So for at least the main key systems we 
really have to get them to work which is why we're trying to get 
all those key things done by J anuary 1999 so we have all of next 
year to test it. 

I don't want to make this whole thing bleak. I want— because we 
are talking about risks but there also are things, some very posi- 
tive things here, because I can see that I'm falling into the trap 
here of just talking only about the risks. I mean, we have imple- 
mented on the application programs a substantial number of 
change programs and put them into production for the filing sea- 
son. It was very successful. It was last year. And that's very impor- 
tant because we actually got the majority, more than half, of our 
applications inventory back into production and already ran 
through a filing season. That doesn't completely test it but it's a 
pretty good sign. We only had a few examples of noticeable failures 
that affected taxpayers in the 1998 filing season. So, that is a very 
positive point to keep in mind. 

Mr. Coyne. Thank you. 

Chairman j ohnson of Connecticut. That's very impressive. 

Mr. Portman. 

Mr. Portman. Thank you. Madam Chair. Commissioner, you 
kind of jumped into a difficult situation here, haven't you? 

Mr. Rossotti. I knew it was here. 
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Mr. PoRTMAN. Yes, I think I speak for all members of this panel; 
we're glad you have the experience and expertise to be able to try 
to run this marathon at a sprinter's pace which is what your 
former CIO, Chief Information Officer, told the IRS Commission 
about a year ago. And I assume from what you're telling us today 
that, in fact, you are sprinting? 

Mr. Rossotti. The date is not going to move. I mean, we have 
to get it done. And really, I think, as Madam Chairman said, we 
really have to get it done, most of it by J anuary 1999. I mean, that 
is a very important observation for the IRS. We have to get it 
through so we can use it for the filing season. 

Mr. PoRTMAN. There's no extension? 

Mr. Rossotti. Pardon me? 

Mr. PoRTMAN. There's no way to file an extension on this dead- 
line? [Laughter.] 

Mr. Rossotti. There's no way to file an extension, yes, exactly. 
It would be good. [Laughter.] 

Mr. PoRTMAN. OK, I've got three quick questions and I hope we 
can get through them, and I appreciate your working through the 
answers quickly also. In that March 31 letter that Bill Coyne just 
referenced, he talked about human resources. And my question to 
you, I guess, goes to some of the disturbing things you mentioned 
in the letter. One, you said you suffered an 8-percent attrition rate 
of your technical staff during fiscal year 1997. That continued, I 
think, until recently. And even though this 10-percent retention al- 
lowance that you give to, I think, about 1,000 programmers has 
helped, it seems to me that you're still not going to be able to do 
this internally. You're going to be relying more and more on the 
contractors, particularly, theTIPSS people, is that correct? 

Mr. Rossotti. Well, yes, but, unfortunately— we are where we 
can but, unfortunately, the contractors are in short supply but 
more importantly for some portions of this, it really is not practical 
to use contractors. I mean, we have to have people that are experi- 
enced. Some of these people in the very short term really can't be 
replaced with contractors. 

Mr. PoRTMAN. How are you going to keep these people? I guess 
my question is do you have the depth of resources, do you have the 
ability to keep the good people you have already, retain contrac- 
tors? 

Mr. Rossotti. Well, we did the six-point program to try to retain 
the people and I don't have up-to-date figures yet. I can get them 
for you, Mr. Portman. 

[The following was subsequently received:] 

Since March 15, 1998, we have been paying a 10% retention aiiowance to over 
800 eligibie technicai staff (Programmers within Information Systems and other 
areas of the agency). Our purpose in paying this aiiowance was to stabiiize and 
ideaiiy, reduce our attrition rate, which stood at 7.9% for fiscai year 1997. At this 
time, it is too soon to teli what impact the 10% retention aiiowance is having on 
our attrition rate. 

We have begun measuring our attrition rate on a quarteriy basis. In addition, we 
wiii simuitaneousiy gather information as to why peopie are ieaving. We expect this 
data to provide us with additionai insight into those workpiace factors (in addition 
to pay) that contribute to retaining quaiified technicai staff, which wiii benefit our 
future recruitment and retention efforts. 

To further address the attrition issue we have recentiy undertaken a series of re- 
cruitment actions combined with additionai hiring incentives as noted beiow. 
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• We have utilized a variety of recruitment vehicles in an attempt to attract a 
diverse and highly qualified group of candidates for our technical vacancies includ- 
ing: OPM's website, paid and unpaid ads in the Washington Post, various military 
publications and websites, technical career job fairs, and local colleges. In response 
the Service has received over 1000 telephone inquiries and numerous electronic mail 
contacts. In addition we have participated in three technical job fairs sponsored by 
private sector and minority organizations. In the first week following a MikeCausey 
column in the Washington Post, publicizing our recruitment efforts, over 500 calls 
were received from potential applicants. 

• Since March 1998, the Service has posted multiple vacancy announcements for 
experienced technical professionals (programmers, systems developers, etc.). We 
have received over 800 applications (combination of external and internal can- 
didates) for these positions. We are screening the applications to determine those 
with the required technical skills and will make selections accordingly. Those va- 
cancy announcements have in some cases included additional hiring incentives such 
as: 

—Potential recruitment bonuses of up to 25 percent of basic salary for new re- 
cruits and potential eligibility for retention allowances for qualified employees who 
remain with the Service for a minimum of 6 months of continuous service. 

—In addition, we are planning to give temporary appointments to qualified re- 
tired annuitants using OPM's recently delegated authority (to IRS) for "waiver of 
dual compensation offset." This waiver will be offered to individuals, on a case by 
case basis, who will be working solely on Year 2000 conversion efforts. 


Mr. Rossotti. But I've heard reports that we seemed to have 
turned it around to some degree. I mean, some of the attrition 
seems to have slowed down but we need to get a couple more 
months' data to see if that's going to be the case. I mean, it's really 
essential to retain the people we have. Part of this was not just the 
money. It was conveying a message to the people that there's really 
a future for these people at the IRS because they've been getting 
a lot of mixed messages about whether there was going to be any 
programmers left at the I RS. 

You know, we're going to need these people, no matter how many 
contractors, we're going to need these people even as we go through 
the modernization blueprint. So, I think we've tried to do a little 
bit in terms of more than just the dollars but getting across the 
message that these people do have a future at the I RS, and that's 
very important. 

Mr. PoRTMAN. Well, I think you need to tell us when that be- 
comes a problem or there needs to be something done because we 
are all familiar with the escalating salaries in the private sector for 
these kind of technicians. 

My next question has to do with the telecommunications. You 
mentioned in your testimony you have a massive set of tele- 
communications networks that are also creating a major challenge 
for you. In response to Mr. Coyne's question, you said it's a high- 
risk area. I just looked over Mr. Flyzik's testimony for later, and 
I know Treasury, through its communications system, believes it 
can meet your neais. You testified before the House Appropriations 
Committee saying that you thought it was a big problem. And my 
question to you is, given the degree to which we transmit data 
through telecommunications and to the degree to which that's real- 
ly important for the IRS' viability and ability to make it through 
the filing season, the next two filing seasons, are you satisfied with 
the progress we've made, and having, again, looked at Mr. Flyzik's 
testimony, do you agree with him that the Treasury system is able 
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to, which is a pretty optimistic view, I think, support all of your 
needs? 

Mr. Rossotti. Well, I think that the question is will we be able 
to make it compliant in time, which is by 1999? And this has been 
a high-risk area and we identified it as a high-risk area. Within the 
last, I would say, month or 6 weeks working with J im and Nancy 
Killefer who is the Assistant Secretary for Management, as well as 
internally, this is not just the Treasury, there are a lot of networks 
inside the I RS. 

In fact, there's more inside of the IRS than there are ones— so 
what we've done is we've set up something that will, I think, make 
this thing work. That is a combined, integrated program manage- 
ment structure that is combined, meaning it includes all the dif- 
ferent pieces of the puzzle in one roof which is really what we need- 
ed. I mean, we were not ever going to get there, I think, treating 
them as separate pieces. 

Mr. PoRTMAN. Do you have contingency plans for the tele- 
communications side? You didn't talk about that in your testimony. 

Mr. Rossotti. I don't have, we don't have the contingency plans 
for the telecommunications side at this point. 

Mr. PoRTMAN. I think that's one we all need more focus on be- 
cause we talk a lot about the computers and less about that critical 
part. 

Mr. Rossotti. I think this combined management program that 
we put together in the last month, I think is really the key to mak- 
ing this whole thing work. 

Mr. PoRTMAN. But without a backup. 

The final question, quickly, with r^ard to electronic filing, as 
you know, in our House-passed legislation, we came up with a solu- 
tion that a signature was not required to be submitted to the IRS, 
that taxpayers could keep that signature on file. As you know, I 
have a bias here. That's the approach that I think makes the most 
sense. It's simple. It doesn't involve some of the Y2K issues that 
some other approaches might. 

You mentioned in that same letter, March 31, that I'm looking 
at that you're developing a pilot project to test alternatives to the 
written signatures, and I just wonder if you believe that approach 
has merit? Again, it seems to me that the simplicity and the low 
taxpayer burden and then the Y2K problems 

Mr. Rossotti. Yes. 

Mr. PoRTMAN [continuing]. Would all suggest moving toward 
doing something that's more in the lines of what we recommended 
in the House side. 

Mr. Rossotti. Yes, I think it does. I think it does. What we're 
trying to do in 1999 is to take advantage of what we've got that 
requires the least change to be able to allow more taxpayers to be 
able to file electronically without having to do this separate trans- 
action. I've got Mr. Barr, who has come with us, who is actually 
focusing on that and we're going to be having some meetings. In 
fact, we were supposed to have them this week but they got post- 
poned until next week to look at what he's going to propose, as to 
how exactly we're going to do this pilot for next year. So maybe 
what I should do is get that and get back to you with a report on 
that particular question. 
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Mr. PoRTMAN. I guess my one comment would be that to the ex- 
tent that we have all these other Y2K problems, why load it up 
with yet another issue 

Mr. Rossotti. Right. 

Mr. PoRTMAN [continuing]. When there may be a simpler ap- 
proach, not just because it's our approach but it's one that I think 
would result 

Mr. Rossotti. OK. We're going to have this, literally within the 
next week we're having meetings on this. I'll get back to you on 
that question. 

[The following was subsequently received:] 

For 1999, the IRS is working toward an authentication piiot as a means of in- 
creasing electronicaiiy-fiied returns. The piiot wiii use an aiternative method of sig- 
nature to repiace the paper signature jurat, Form 8453. Based on the responses to 
Eiectronic Tax Administration's Request for Proposais, the IRS is currentiy consid- 
ering a number of options for testing aiternative methods next fiiing season. 


Mr. PoRTMAN. Thank you. Thank you. Madam Chair. 

Chairman] ohnson of Connecticut. Mr. Kleczka. 

Mr. Kleczka. Thank you. Madam Chair. Mr. Commissioner, 
thank you for appearing today. I also admire your courage in ac- 
cepting this responsibility to run the Service. Now, as I understand 
some of the future tasks ahead for you, you have about 700 to 800 
tax changes that have to be put online as per the 1997 tax bill, you 
have a major IRS reform bill that the IRS will have to implement 
in a short period of time. There's talk here in Congress of another 
major tax bill for 1998 which naturally will have to be up and run- 
ning by 1999. And then you have the year 2000 problem. 

Now, I know if you don't get all this accomplished, there will be 
folks around the Capitol here that are going to be after your hide. 
And I think that's something you probably already have accepted. 
But my question is, and I think it's something that you have to put 
in the record, do you have the resources to complete all of these 
tasks? I know full well that you're on the Hill every day responding 
to congressional hearings. You're here again today. The Service is 
not held in the highest regard nationwide. What can we provide to 
you so that all these tasks can be accomplished? 

Mr. Rossotti. I think what we need most is to work with you 
on the timing of new requirements. I mean, and, of course, the 
budget is also important. Although, I will say for fiscal 1998, for 
this moment, we've gotten the budget that we need. We really have 
the dollar resources for this fiscal year, and as we go forward, the 
1999 appropriations, we'll have to look at that. But for this fiscal 
year we've got it. But you're quite right. I mean, we have an ex- 
traordinarily thin management structure at the IRS. We've got 
quite a few vacant positions in key management positions, espe- 
cially in information technology and we have a lot going on and I 
think this is exactly why, I mean, this is the fundamental reason 
why I've asked so strongly that the effective dates on some of the 
new provisions in the new bill be postponed. It's not the substance 
of them, it's just the practical issue of how to get them done. I real- 
ly ask that those be put out. 
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In most cases, there are a few exceptions, but in most cases, out 
beyond year 2000, which I know is a long time and it's not some- 
thing that people like, but it's the honest statement of what I think 
we have to do to try to have a chance to succeed with this. I think, 
you know, obviously that would be equally true of any new, any ad- 
ditional tax bills that might be passed. It would be a matter of 
when these dates are made effective, you know, depending on the 
provisions. 

Some of them may not affect computer systems that much but 
any that affect computer systems, and most of them do, really for 
the rest of this calendar year we really cannot cram anything more 
into the situation. It's already high risk, and to put more in is real- 
ly not reasonable. Even in 1999, in theory, we will have additional 
capacity in 1999 in order to implement in the year 2000, after the 
date change. And from a purely numerical standpoint, in terms of 
staff capacity, we do have some, but we also have all these risks 
of integrating all these things and so there's a great deal of uncer- 
tainty as to how much even we'll be able to do in 1999. 

Mr. Kleczka. OK, well, I respect you coming forward and saying 
that when it comes to the IRS reform bill, there are some things 
you just can't accomplish immediately. Know full well, we want it 
done yesterday not tomorrow. But as we go through this session 
and, as the Ways and Means Committee looks at the Tax Code 
again, I would hope that you would not be bashful of coming for- 
ward again and saying, 'This is overload for the agency, my 
friends. We just can't do it. We ask that you consider a different 
track." So I, when you come before the Full Committee later in the 
year, I 'll be again broaching this same subject matter to make sure 
that we're not setting you and the agency up for failure, which I 
think would be very unfair. 

Thank you very much. 

Chairman J ohnson of Connecticut. Thank you. 

Mr. Hulshof. 

Mr. Hulshof. Mr. Commissioner, I certainly don't want to be 
seen as piling on and appreciate the very forthright nature in 
which you've presented yourself these past weeks. Because we've 
got some excellent witnesses and I 'm sort of reading ahead, I want- 
ed to present to you some of the concerns that GAO has suggested. 
I know in your written testimony you mention that you did, in fact, 
consult GAO, particularly as it relates to mitigating risks and 
there's a concern that's been expressed by GAO regarding the con- 
tingency plan, and I just wanted to mention this and then ask for 
your comment. 

One of the concerns that GAO has raised is that your contin- 
gency management plan doesn't address a likelihood that informa- 
tion systems that are converted on schedule may experience some 
systems failures. Would you care to comment on that particular 
concern? 

Mr. Rossotti. First of all, let me say that I think that one of the 
resources that I'm trying to make use of to identify risks such as, 
I mean, the whole point of managing a project like this is to iden- 
tify risks, get them out there, and take action as early as possible. 
And I've been using every resource I can, including GAO, very 
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helpfully. In fact, now, I've got GAO, you know, attending our own 
steering committee meeting so we're welcoming this kind of input. 

I think with respect to contingency plans we do need to do more 
on contingency plans. In some cases, we've already taken some ac- 
tion like in mainframe consolidations. The difficulty we have, 
frankly, is that in some cases it may not be practical really to de- 
velop really very viable contingency plans for some aspects of what 
we're doi ng. 

But, second, the other problem we have is that the very people 
who are managing the program, in many cases, are the people who 
would have to divert time to developing contingency plans. I mean, 
given that our limited resource is management, which it really is 
even more a limiting of factor, as much of a limiting factor as staff, 
we even have to be careful to allocate our management resources 
to even doing things like contingency plans. We are going to do 
more in that area, and there are some that we've already done. We 
certainly are going to continue a very intense dialog with GAO on 
trying to get their help in identifying these risks and responding 
to them. But, in the end, we do have to sort of allocate our critical 
resources in the best way we can. And we really don't have enough 
to do everything that we'd like to do in some areas. 

Mr. Hulshof. Do you see as a problem, and Mrs. J ohnson asked 
a question about, that the time tables are somewhat fluid. I think 
initially the hope was that 10 service centers would be up and 
ready to go by J anuary 1999, now somewhat of a fudge factor that 
maybe we'll get five online, I mean, do you see this as potentially 
exacerbating the problem regarding contingency plans? 

Mr. Rossotti. Well, in the mainframe project, with the consoli- 
dation project, which is a very large project, that is one where be- 
cause of its size and because there are practical options we are im- 
plementing a contingency plan which is practical. In fact, we're al- 
ready doing it. We're going to upgrade the operating software for 
the mainframes that are in the service centers so that even if we 
don't convert them, we will still be able to operate them. It won't 
be as efficient. It will cost more money but we'll still be able to do 
it. There is another piece, this broad project called "mainframe" ac- 
tually has about five pieces to it. 

There is another piece, a very important piece, which is a com- 
munications computer which really has no contingency plan, prac- 
tically speaking, because we really have to replace that. It's sort of 
in the middle of everything. But we have put a lot of emphasis on 
that piece, obviously, and that one we are, more or less, on sched- 
ule and we will be able to get that one through. So this is what 
we're— when I said, adjusting, this is the kind of thing we're doing. 
We keep drilling down deeper and deeper and say, well, this is the 
piece that's absolutely critical; we don't have a backup; we've got 
to get it done, and you put the emphasis on it. The other part you 
find a way, you know, allocate your resources that it can at least, 
you know, be sure to get you through even if you don't do it exactly 
the way you want it to. And that's the kind of thing that consumes 
an immense amount of management time, our scarce resource. 

Mr. Hulshof. Thank you. Commissioner. And Madam Chair- 
man, I yield back. 

Chairman j OHNSON of Connecticut. Thank you, Mr. Hulshof. 
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Ms. Dunn. 

Ms. Dunn. Thank you, Madam Chairman. This is fascinating to 
hear you. We're very glad you're there, Mr. Rossotti, because we 
know that you understand the problems we've had with the IRS in 
the past, and that you're a management expert and you're going to 
do the best you can. And we all hope that working together we can 
make it turn out to be a really good job. 

I was pleased in your testimony that you talked about some of 
the opportunities you have and I think that will be useful informa- 
tion to put at the beginning of any speech you give on this because 
we all realize how complicated this Y2K problem is going to be. I 
speak, having the background of a former systems analyst for IBM 
and, because I recall spending many nights and weekends at busi- 
nesses to whom the equipment was oversold trying to bail people 
out and trying to find the bugs in the system. I guess I focus most- 
ly on the complicated aspect of testing the changes that are going 
to be made. And I wonder if you could spend a minute or two just 
telling us what your experts have told you on how you're going to 
do this testing, and whether you're going to run parallel systems, 
or how are we going to know by the year 2000 that we're not going 
to have a problem collecting taxes from the people who are out 
there trying to pay them? 

Mr. Rossotti. First of all, let me say that your focus on testing 
data is on target. I mean, that's the hardest part of this whole pro- 
gram, I mean other than just managing the whole thing together, 
but without a doubt, testing. And the reason is because obviously 
even though each little change is fairly simple, as some of the other 
Members had noticed, when you have this many thousands and 
thousands of changes in many different kinds of components, find- 
ing the place where there's an error when it all fits together is the 
hard part. And I think that, therefore, what, I think, we're trying 
to do is we're trying to have testing at many levels. We're testing 
each, you know, at the component level. For example, in the pro- 
grams there's testing, there's testing of the systems, the individual 
application systems before we put them, for example, back into the 
filing season. 

On the telecommunications network, with Mr. Flyzik's help with 
the contractor that's working with us there, they have test lab set 
up where they're testing in the case of these different vendor com- 
ponents that they all fit together at the lab level. And then we've 
got another contractor, I mean, I hope I 'm not being too long. We've 
got another contractor which is from the original Bell companies 
that's a telecommunications expert company that's doing a special 
test of some of the end-to-end pieces in the telecommunications net- 
work. We have another lab that's testing our minicomputers. So 
we've got all these levels of testing. Then the next and last piece, 
or the last piece is really the big integrated end-to-end test that we 
have to do I n 1999 and that's really an unprecedented test. I mean, 

I was in the business for 28 years, I never heard of anything this 
big anywhere. So we are working now, OK, with a contractor to de- 
velop that end-to-end test and we're just turning our attention in 
a serious way now to figuring out how to do that. OK, that is really 
breaking some new ground as far as I 'm aware. 

Chairman j ohnson of Connecticut. Mr. Ramstad. 
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Mr. Ramstad. Thank you, Madam Chair, and thank you. Com- 
missioner. I know there are five witnesses waiting behind you. I 
know you have another commitment, so I'll be brief. First of all, I 
wouldn't trade jobs with you. Second, concerning the 2000 problem, 

I just finished a series of town meetings and, like most of my col- 
leagues, this is becoming a dominant concern among the people. 
There's more concern, especially among older Americans about So- 
cial Security checks. I n fact, it's pretty unanimous that if you're not 
ready there's not a big concern out there— [Laughter.] But if you 
aren't there's a major worry. Let me just follow up, if I may Com- 
missioner, on your exchange with Mr. Hulshof about replacing the 
communications replacement system. Is that going to be done in all 
10 service centers or just those that will be consolidated? 

Mr. Rossotti. No, that will be in all 10 service centers. That 
piece is essential in order to make the whole framework. And that's 
on a much more accelerated schedule. We're in the testing phase 
of that right now and we would be, I don't remember exactly, we 
can get you that, what the rollout is for that. But that one we are 
definitely planning to roll out this year to all 10 service centers. 

Mr. Ramstad. And that's essentially on schedule? 

Mr. Rossotti. Yes, as of now. I always qualify those things be- 
cause tomorrow we could get a test and find out we've got a new 
problem but I believe that that one is getting intense focus because 
It's so critical to making the whole rest of the thing work. 

Mr. Ramstad. Thank you, again. Commissioner. Thank you. 
Madam Chair. I yield back. 

Chairman j ohnson of Connecticut. Thank you very much. Com- 
missioner. We certainly do appreciate your knowledge, experience, 
your personal energy, and your leadership abilities. But I think we 
appreciate more seriously your honesty and straightforwardness 
with us, you are so cognizant of the enormity of this challenge and 
we'll work with you to make sure that the Congress backs you in 
every way we can to assure your success in what you so, I think, 
honestly describe as a dangerous and risky situation but not one 
that you are not aggressively working to manage and solve. Thank 
you for being with us this morning. 

Mr. Rossotti. Thank you. Madam Chair. 

Chairman j ohnson of Connecticut. Mr. Callahan. 

STATEMENT OF HON. JOHN CALLAHAN, ASSISTANT 
SECRETARY, MANAGEMENT AND BUDGET; AND CHIEF 
INFORMATION OFFICER, U.S. DEPARTMENT OF HEALTH AND 
HUMAN SERVICES; ACCOMPANIED BY GARY CHRISTOPH, 
CHIEF INFORMATION OFFICER, HEALTH CARE FINANCING 
ADMINISTRATION; ELIZABETH JAMES, CHIEF INFORMATION 
OFFICER, ADMINISTRATION FOR CHILDREN AND FAMILIES; 
AND NORM THOMPSON, ASSOCIATE COMMISSIONER FOR 
AUTOMATION AND SPECIAL PROJECTS, ADMINISTRATION 
FOR CHILDREN AND FAMILIES 

Mr. Callahan. Thank you very much. Madam Chairman j ohn- 
son, Congressman Coyne, and other Members of the Subcommittee. 

I want to thank you for the opportunity to testify here today for 
the Department of Health and Human Services. I am the CIO, 
Chief I nformation Officer, for the Department and today I 'm accom- 
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panied by Dr. Gary Christoph, for CIO for HCFA; Dr. Elizabeth 
J ames, the CIO for the Administration for Children and Families; 
and Norm Thompson is the Associate Commissioner for Automa- 
tion at ACF. All of these individuals plus myself will make our- 
selves available to the Subcommittee at any time that they have 
questions now or in the future. 

I submit to the record my written testimony, as well as our re- 
port to 0MB in February 1998 which gives the full scope of what 
the Department is doing to correct its year 2000 computer prob- 
lems. 

[The report is being retained in the Committee files.] 

I'd like to comment on three areas. One, the Y2K dTort at FI FIS 
as a whole, just in general, then FICFA, then ACF. With regard to 
the Department as a whole, the Secretary, the Deputy Secretary, 
and myself have all indicated that year 2000 compliance is job 
number one for the Department. It is the top and only information 
technology that we intend to pursue with all the resources at our 
disposal. 

What have we done this year? First of all, we've ensured that we 
have a December 31, 1998, deadline for year 2K compliance for all 
our mission-critical systems. We have 491 in the Department as a 
whole. We have a clear structure of administrative accountability. 
Every agency has a CIO. That CIO reports directly to its agency 
head, and they're responsible also to me, the Deputy Secretary, and 
the Secretary. We have required and are requiring independent 
validation and verification testing for all our mission-critical sys- 
tems. We were the first agency to seek and to receive from the Of- 
fice of Personnel Management authority to hire Federal retirees 
who have the skills to help us fix the year 2000 problem. We 
sought this at the end of last month, and we have received author- 
ity to hire up to 45 Federal retirees. 

We are, as you requested, and others have requested, developing 
contingency plans for all our major agencies. We've shared our data 
interfaces, we've identified our data interfaces with all our State 
partners. We've shared these with the National Association of State 
Information Resource officials as of April 22. And, then, finally, as 
is indicated in our testimony, we have up and running a biomedical 
Web site, which is maintain^ by FDA, wherein individuals can de- 
termine the Y2K compliance of all biomedical manufacturers which 
are so important to direct our health facilities and things of that 
nature. So that is up and running at the moment. 

Obviously, the biggest problem that we face in the Department 
is dealing with the year 2000 and FICFA. We have 25 internal 
mission-critical systems, and 75 external contractor mission-critical 
systems. Forty-nine million lines of code are in these systems, 19 
million lines of code in our internal systems, 30 in our external sys- 
tems. These need to be examined in order to be made Y2K compli- 
ant. This software, which is basically the engine, if you will, that 
allows 900 million fee-for-service claims to be paid annually by 
Medicare to more than 33 million beneficiaries and countless num- 
ber of Medicare providers. 

What are we doing in this regard? We have created and we have 
hired Dr. Gary Christoph from Los Alamos Laboratory as our CIO 
after a nationwide search. Fie and NancyAnn Min-DeParle have 
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created "tiger teams," for all our internal systems in order to make 
them year 2K compliant and they are using the personnel authori- 
ties that I describea earlier to get additional personnel. 

On the fiscal front, we have, as a result of the supplemental that 
was recently passed here and the President signed, we have chan- 
neled $20 million from ongoing transition work to single part A to 
part B systems to our year 2000 effort. We estimate that we may 
need $103 million more in 1998 and 1999 for our year 2K work. 
We have authorities at our disposal including the Secretary's 1- 
percent transfer authority which is in our annual appropriations 
act and we will be prepared to use that in order to channel addi- 
tional moneys to the Y2K effort. 

And Nan^Ann Min-DeParle, who's the Administrator of HCFA, 
has said on numerous occasions that year 2000 is her top priority. 
She's been very proactive with her contractors, and we have fin- 
ished, just about finished all our site visits with our 75 contractors 
to, again, talk to them about the urgency of the year 2K problem 
and to determine what they can and should be doing in that re- 
gard. 

One element I would draw your attention to is that we have sent 
up to the Congress on J anuary 1998 contractor reform legislation. 
This allows HCFA to have increased discretion in contracting for 
Medicare claims processing and payment. It would allow the ad- 
ministrator to contract for these functions on a best-value basis as 
permitted by the Federal acquisition regulations. We believe this 
legislation is important so that we can exercise contingency plans 
and long-term planning in order to permit business continuity in 
light of any contractor failure. This legislation would eliminate the 
rigidities that we believe are now inherent in current contracting 
law, under Medicare, which requires us to contract with only se- 
lected claims processors, provides for automatic contract renewal, 
and reimbursement for all allowable costs. Our feeling is that the 
Federal acquisition regulation law, if that were applied to Medicare 
contractors, the contractor system, would be a positive benefit. We 
do not feel that competent contractors would have anything to fear 
from this legislation, and would not be harmed by the legislation 
if it were passed. 

Let me now just focus quickly on the Administration for Children 
and Families. We have 55 mission-critical systems in ACF. Twelve 
are now year 2000 compliant. We think as many as 33 will be more 
compliant by the end of this quarter. Forty-one are being repaired 
or replaced and two are being retired. There are two main areas 
in the Administration for Children and Families: One is grants ad- 
ministration, the other is child support enforcement. We believe 
that all the grant systems, grant information systems will be made 
compliant and that our grants processing system under ACF will 
be made compliant through a new system called Gates by the end 
of this year. 

State data interfaces, that I mentioned earlier, we are handling 
that through what we call an electronic bridging system, which 
we're also using in CDC. All States that have to send information 
to us in the ACF systems, we will be able to accept that data 
whether it's year 2000 compliant or not, and bridge it into our sys- 
tem so that the data in fact is compliant. As I say, we used the 
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system, or are using the system also for CDC for very important 
epidemiological data. 

With regard to child support, we expect the Federal Parent Loca- 
tor System to be compliant by October 1, 1998, and the new higher 
data system which was required by recent wdfare reform legisla- 
tion is now being developed as a year 2000 compliant system. Five 
of our legacy systems in child support are moving to the SSA main- 
frame later this year. 

One issue that I know Mr. Rossotti touched on which we had 
made progress in the Department is data center consolidation. We 
now have only three mainframe centers, really working 
mainframes in the Department, one at FICFA, one at NIFI, and one 
at CDC. We have completed our data center consolidation system 
some time ago at a savings of about $127 million over a number 
of years. 

State child support systems, as we all know here, are in effect 
the responsibilities of individual States. We had a meeting with a 
number of State CIOs recently, including the State CIO from 
Washington. I think they feel th^'re making good progress at the 
State level to make sure that their child support systems are com- 
pliant. We are able to help them out because they can support their 
Y2K compliance spending at the State level through the matching 
of child support grants which are 66% percent. But we do think 
the States are working hard, and that they will succeed but obvi- 
ously they have complex systems as well. 

I would just say, in conclusion. Madam Chairman, we certainly 
regard year 2000 as our job number one. We will be accountable 
to the President. We will be accountable to the Congress and we 
will work with you continuously on this problem throughout the re- 
maining time here before the year 2000. We do think that our basic 
job, certainly from headquarters is to do three things. We have to 
focus the resources, the money, we have to focus the personnel, and 
whatever authorities those people need to get the job done. We will 
deploy frontline people to get the job done and we intend to do that 
and will keep this Subcommittee fully informed of our efforts. 

Thank you and I would be happy to answer any questions. 

[The prepared statement follows:] 

statement of Hon. J ohn Callahan, Assistant Secretary, Management and 

Budget; and Chief Information Officer, U.S. Department of Health and 

Human Services 

Good morning. I am John Callahan, Assistant Secretary of the Department of 
Health and Human Services for Management and Budget (ASMB) and Chief Infor- 
mation Officer (CIO). I am pleased to appear before this Subcommittee to provide 
you with a report on the accomplishments of the Department and the challenges 
faced by the Department in assuring that our systems are Millennium compliant. 
We will especially emphasize the Year 2000 progress made by HCFA and ACF. I 
am accompanied today by Gary Christoph, CIO of the Health Care Financing Ad- 
ministration (HCFA), and by Elizabeth J ames, CIO of the Administration for Chil- 
dren and Families (ACF), and Norm Thompson, Associate Commissioner for Auto- 
mation and Special Projects in ACF's Office of Child Support Enforcement. 

HHS'Year 2000 Effort 

The Secretary, the Deputy Secretary, and I have declared the Year 2000 (Y2K) 
date issue to be our highest information technology priority. We have already taken 
several steps, and we will continue to take action, to ensure that all HHS informa- 
tion systems are Year 2000 compliant. We have involved all parts of our organiza- 
tion, including staff with expertise in information systems, budget, human re- 
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sources, and acquisition management in solving the Year 2000 problem. No matter 
what else we do and what other initiatives we undertake, we must ensure that our 
ability to accomplish the Department's mission is not impaired. 

For this reason, we have established December 31, 1998 as our internal deadline 
for Year 2000 compliance of mission critical systems. This was done in order to pro- 
vide a full year of operations in which to detect and remedy any adverse interactions 
among FiFIS systems and those of our many service partners, including other Fed- 
eral agencies, state and local governments, tribes, and contractors. 

To meet our Year 2000 responsibilities, we have taken a series of strong adminis- 
trative actions. We have established direct reporting lines between staff working on 
Year 2000 activities and all Operating Division (OPDIV) Chief Information Officers; 
and each OPDIV CIO is responsible for regular reporting on Y2K efforts directly to 
the OPDIV head and tome, until Year 2000 date compliance is accomplished. 

I n our February 1998 quarterly report to the Congress, FIFIS reported 491 mission 
critical systems. About 40 percent of these systems are now Year 2000 compliant. 
We closely monitor progress and maintain a monthly reporting system to track 
progress on all of our data systems. Our monitoring system prompts remedial action 
where and when necessary and encourages examination of systems that may be able 
to be retired, thereby making better use of limited Year 2000 resources. In addition, 
our OPDIVs have compiled inventories of their system interfaces, and have con- 
tacted their interface partners. On April 22, I provided a listing of state interfaces 
to the National Association of State Information Resources Executives (NASI RE). 
Because testing, including independent verification and validation (IV&V), is critical 
to our Year 2000 effort, we are requiring our OPDIVs to subject their systems to 
stringent testing and IV&V. We also know there is a possibility that, try as we 
might, some systems may not be fully compliant in time. Therefore, we are requir- 
ing the OPDIVs to develop contingent plans that permit business continuity in the 
event of system failure. These contingency plans will be noted in our next Year 2000 
quarterly report. 

We are taking action to retain, re-employ, and attract qualified information tech- 
nology professionals, using both employment and contracting authorities. On March 
31, we received Department-wide personnel authorities from the Office of Personnel 
Management (0PM) to waive the pay and retirement reduction for re-employed mili- 
tary and civilian retirees who return to work on Y2K remediation. 

Late last week, the President signed a 1998 supplemental appropriations bill di- 
recting $20 million of FICFA contractor funds to be redirected toward FICFA's Year 
2000 remediation efforts. While these funds will certainly help, FICFA still must 
find ways to address the shortfall. We estimate that FICFA will require additional 
Year 2000 funding in FY 1998 and FY 1999. In FY 1998, HCFA estimates it needs 
an additional $43 million, and in FY 1999, FICFA may require an additional $60 
million for FICFA contractor remediation efforts. For FY 1998, we will soon be send- 
ing to Congress a letter notifying you of our intent to use the Secretary's one- 
percent transfer authority to shift funds from other FIFIS activities to make the ad- 
ditional $43 million available for FICFA's Y2K efforts. While cutting funding for 
other activities is never easy, and all may not be happy with our choices for offsets, 
we would appreciate Congress' support for our effort to give FICFA the resources 
necessary to address this problem. 

FIealth Care Financing Administration Challenges 

Our greatest Year 2000 concern is for FICFA's Medicare program. This program 
is run by over seventy external contractors, including several shared systems main- 
tainers, who operate and maintain a base of software programs that process 900 
million fee-for-servi ce claims payments annually for nearly 33 million Medicare 
beneficiaries. Nearly one quarter of the external Medicare contractors have not yet 
completed assessments of their systems. Flowever, under the current law (Title 
XVIII of the Social Security Act) FICFA has limited authority for addressing the 
Year 2000 threat to Medicare systems. This situation illustrates why Medicare con- 
tracting reform has been and continues to be an Administration priority. 

There are a number of facets to FICFA's current contracting authority that hinder 
FICFA's ability to aggressively orchestrate Year 2000 compliance. 

Medicare claims processing contract terms are unique and differ in several impor- 
tant respects from typical Federal contracts awarded under Federal Acquisition Reg- 
ulation. Medicare statutes require FICFA to contract for services with insurance 
companies only— not computer or transaction processing firms— and only on a cost 
reimbursement basis 

Intermediary and carrier contracts provide for automatic renewal on an annual 
basis. Furthermore, FICFA may terminate a contract only for cause and not for con- 



35 


venience, while contractors may leave the Medicare program with 180 days notice. 
It generally takes HCFA six to nine months to transfer a contractor's workload to 
another contractor organization. 

Most importantly, because HCFA is required to reimburse its Medicare contrac- 
tors for all allowable costs, the agency's ability to exert financial leverage over its 
contractors to direct funds toward such activities as Year 2000 compliance is lim- 
ited. 

HCFA has been proactive in exerting what pressure is possible on the Medicare 
contractors with regard to Year 2000 compliance. HCFA has proposed amendments 
to Medicare contracts requiring millennium compliance, and has released guidance 
that would provide more restrictive definitions of compliance and testing require- 
ments. Nonetheless, we remain greatly concerned about the need for a faster pace 
of progress by Medicare contractors in meeting our Year 2000 goal. 

As I stated earlier, problems surrounding Year 2000 compliance are an illustra- 
tion of why the Administration has proposed contracting reform legislation. On Feb- 
ruary 27, 1998, HHS sent a proposal for Medicare contractor reform to Congress. 
This proposal would amend the Medicare statute regarding HCFA-contractor rela- 
tions. Our proposal would provide the Secretary with greater flexibility for manag- 
ing the Medicare program, and allow increased discretion in contracting for claims 
processing and payment functions. Under this authority, the Secretary could award 
contracts from a larger pool of qualified contractors. We believe that this change 
would promote competition and potentially allow the Medicare program to obtain 
better value for its dollar. The new authority would also be especially helpful in al- 
lowing the Secretary to enforce contingency plans that permit business continuity 
in the event of system failure. This proposal has received the endorsement of J ohn 
Koskinen, Special Assistant to the President for Year 2000, in testimony before the 
Senate Governmental Affairs Committee. 

The proposal would allow the Secretary to contract for Medicare functions on a 
best value basis as permitted by the Federal Acquisition Regulations (FAR). It 
would change Medicare law to permit the Secretary to follow the FAR in adminis- 
trative contracting. We would then be able to determine on a case-by-case basis the 
most appropriate contractual arrangements, with fixed price and incentive provi- 
sions, for example. 

We have requested Medicare contracting reform from Congress for a number of 
years and recently submitted a proposal with our FY 1999 Budget request. While 
we understand that, due to uncontrollable variables, no organization can provide an 
absolute guarantee of end-to-end processing throughout the Millennium change, 
swift passage of this legislation now will provide HCFA with greater leverage to 
proactively manage Medicare contractors. We therefore, respectfully request, and 
encourage, your assistance in securing enactment of this very important proposal. 

We recognize that HCFA will continue to face a daunting and exhausting effort 
that contractor reform alone cannot address. As noted earlier, this will require addi- 
tional resources to be used for contractor Year 2000 remediation or testing and inde- 
pendent verification and validation. We will especially depend on HCFA's IV&V con- 
tractor, who will review both internal and contractor remediation efforts. HCFA's 
testing contractor will provide independent assurance that Medicare claims process- 
ing systems will operate properly in the next Millennium. 

Administration for Children and Families Challenges 

ACF has 55 mission critical systems. Of these systems, 12 are compliant, three 
are being repaired, 38 are being replaced, and two are being retired. ACF processes 
nearly 7,000 grants per year. 

ACF's mission critical systems fall into two major categories. These categories are 
grants and child support enforcement. Approximately 40 ACF systems award grant 
funds and track the grants ranking and approval process, as well as tracking finan- 
cial and program information, for example, how many children are enrolled in a 
local Head Start program. 

Child support enforcement systems include the Federal Parent Locator Service 
(FPLS), which helps States to find non-custodial parents for purposes of establishing 
or enforcing child support orders. The FPLS allows the States to search Federal 
Government data bases for information such as Social Security records and Internal 
Revenue Service tax information. The FPLS will be compliant by October 1, 1998. 

A new system mandated by the Personal Responsibility, and Work Opportunity 
Reconciliation Act, the New Hires data base, receives and processes information 
from all employers about newly hired employees. Knowing when an employee is 
newly hired or changes jobs can provide information that allows States to provide 
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more timely location of absent parents. The New Hires Data Base was developed 
as a Year 2000 compliant system. 

ACF has completed the identification of its data exchanges and has established 
contact with its data trading partners. Many of ACF's data exchanges are incoming 
only. Much like the Centers for Disease Control, ACF is relying heavily on electronic 
bridging to convert non-compliant information, thereby avoiding difficult-to-detect 
"soft failure" caused by bad data. 

I n fact, ACF's contingency plans to ensure the continuity of operations, should the 
need arise, will rely on electronic bridging to exchange information. For example, 
the Office of Child Support Enforcement systems will use electronic bridges devel- 
oped as part of the renovation process to allow ACF to successfully exchange and 
process both compliant and non-compliant data. In addition, ACF's systems for proc- 
essing grants are being replaced by a Year 2000 compliant client-server system 
called GATES. 

ACF is working closely with its state partners to ensure that the states continue 
to devote sufficient attention to Year 2000 issues. As noted above, many state sys- 
tems, including most of the child support enforcement systems, have been developed 
over the last five years and are Year 2000 compliant. Yet, some older systems, for 
example in the welfare programs, may need work. ACF will maintain a dialogue 
with the states, and will provide assistance where necessary 

Biomedical Equipment Outreach Activities 

Our Year 2000 related activities are not limited solely to HHS programs alone. 
On J anuary 21, 1998, Deputy Secretary Kevin Thurm signed a letter, sent to over 
16,000 biomedical equipment manufacturers, strongly urging them to identify non- 
compliant products, and the actions they are taking to ensure compliance. The man- 
ufacturers are now responding to this survey developed by my office and the Food 
and Drug Administration (FDA). The FDA now operates and maintains a public 
Internet web site listing all biomedical equipment information received from the 
manufacturers relating to Year 2000 compliance. The web site is operational and 
FDA is currently posting the manufacturer responses on the Internet "http:/ 
www.fda.gov/cdrh/yr2000/y ear2000.html.". 

We are planning additional outreach activities, beyond the biomedical equipment 
issues, to inform the health and human services community in general about Year 
2000 issues. These issues include the potential for Year 2000 problems with facili- 
ties equipment, telecommunication products, and commercial off-the-shelf software 
that runs automated information systems. 

Conclusion 

HHS still faces substantial challenges in our Year 2000 efforts. However, let me 
assure you, on behalf of Secretary Shalala and Deputy Secretary Kevin Thurm, that 
we will continue to vigorously pursue Year 2000 remediation as our most important 
information technology initiative. We recognize our obligation to the American peo- 
ple to assure that HHS's programs function properly now and in the next millen- 
nium. 

I thank the Committee for its interest and oversight on this issue, and would be 
happy to answer any questions you may have. 


Chairman J ohnson of Connecticut. Thank you, Mr. Caiiahan. 

Mr. Dyer. 

STATEMENT OF J OHN DYER, PRINCIPAL DEPUTY 
COMMISSIONER, SOCIAL SECURITY ADMINISTRATION 

Mr. Dyer. Chairman Johnson, Members of the Subcommittee, 
i'm pieased to be here to testify today concerning the Sociai Secu- 
rity Administration's efforts to prepare for year 2000. SSA became 
aware of the year 2000 probiem and began pianning for it in 1989 
to make sure that the payments that we make to more than 48 
miiiion beneficiaries wiii not be in jeopardy. Let me assure you that 
Commissioner Apfei and the senior staff at SSA are weii aware of 
the great importance of aii the issues surrounding year 2000 com- 
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puter problems. As Commissioner Apfel testified before the Sub- 
committees on Social Security and Human Resources this year, 
"preparing for year 2000 is unquestionably the biggest challenge 
the information technology industry has ever faced." 

How are we progressing at SSA to resolve the year 2000 prob- 
lems? As of April 30, 1998, SSA has renovated more than 90 per- 
cent of the agency mission-critical systems that support our core 
business processes: Enumeration, earnings, claims, postentitle- 
ment, and informing the public. We are scheduled to complete all 
testing of all systems by December 31, 1998, and have all systems 
implemented into production in J anuary 1999 providing a full year 
for post implementation review. Beyond computer software, we nave 
developed plans to address the year 2000 problem in the areas of 
telecommunications, hardware infrastructure, and facilities infra- 
structure. We have plans in place to upgrade or replace all non- 
compliant equipment and are working with the vendor community. 
General Services Administration, and the CIO Council Committee 
on Year 2000 to test vendor fixes. 

What obstacles do we have yet ahead of us? I n October 1997, the 
General Accounting Office issued a report entitled "Social Security 
Administration: Significant Progress in Year 2000 Effort, But Key 
Risks Remain." The report was generally complimentary of our 
year 2000 program. However, it identified three concerns: The 
States' Disability Determination Services systems compliance, data 
exchanges, and contingency planning which we are addressing at 
this time, and will continue to address. 

Now, let me talk about them individually. In terms of the State 
disability compliance, we have focused our attention on ensuring 
that the State's Disability Determination Services, or DDSs, as we 
call them, systems which are used to determine medical eligibility 
of disability applicants are made year 2000 compliant by the end 
of December 1998. Each State has developed a plan for year 2000 
conversion and SSA, working closely with each State, monitors the 
progress of each State against its project milestones. As of today, 
21 of the 55 DDS systems have been renovated, tested, and imple- 
mented. 

Data exchanges: We have been actively addressing the issue of 
data exchanges which occur between SSA, other Federal agencies. 
States, and third parties. Thus far, 65 percent of our data ex- 
changes are year 2000 compliant and implemented. Our target is 
to have all data exchanges implemented by December 1998. We are 
focusing particular attention on our exchanges with affected benefit 
payments. We are working very closely with the Treasury Depart- 
ment to ensure that Social Security and Supplemental Security In- 
come checks and direct deposit payments for J anuary 2000 will be 
on time. In addition to testing with Treasury, which we started 
March 4 of this year, we have agreements to test from SSA through 
Treasury and the Federal Reserve's automated clearinghouse for 
our direct deposit payments. 

Contingency planning: On March 31, 1998, we issued the SSA 
Business Continuity and Contingency Plan. The plan addresses the 
core business functions, including disability claims processing func- 
tions supported by the DDSs which must be supported if year 2000 
conversion activities experience unforeseen disruptions. The plan 
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identifies potential risks to business processes, ways to mitigate 
each risk, and strategies for ensuring continuity of operations if 
planned corrections are not completed or if systems fail to operate 
as intended. We certainly hope there will be no need to activate our 
contingency plan. However, if there are unforeseen problems or 
year 2000 disruptions, the contingency plan will be implemented to 
ensure continuation of SSA's vital service to the public. 

Because of our early attention to this challenge, we are confident 
that our systems will function on and after year 2000 to ensure 
that our core business processes proceed smoothly and without dis- 
ruption as we move into the 21st century. When we open our of- 
fices for business on J anuary 3, 2000, we expect to be prepared to 
provide the full complement of services to the American public with 
the accuracy and reliability they have come to expect from us. And 
if there are unforeseen problems, we have contingency plans in 
place to assure continuation of our operations. 

I 'd be happy to answer any questions you may have. Thank you. 

[The prepared statement follows:] 

statement of J ohn Dyer, Principal Deputy Commissioner, Social Security 

Administration 

Chairman J ohnson and Members of the Subcommittee: 

I am pieased to be here to testify today concerning the Sociai Security Administra- 
tion's (SSA) efforts to prepare for the Year 2000. SSA became aware of the Year 
2000 probiem and began pianning for it in 1989 to make sure that the payments 
we maketo morethan 48 miiiion beneficiaries wiii not be in jeopardy. 

Let me first assure you that Commissioner Apfei and aii the Senior Staff at SSA 
are weii aware of the great importance of aii the issues surrounding the Year 2000 
computer probiem. As Commissioner Apfei testified before the Subcommittees on So- 
ciai Security and Human Resources on March 12, 1998, "Preparing for the year 
2000 is unquestionabiy the biggest chaiienge the information technoiogy industry 
has ever faced." 

Because we were on the forefront of Year 2000 preparation, our Assistant Deputy 
Commissioner for Systems, Kathieen Adams, was asked to Chair the Chief Informa- 
tion Officers (CIO) Council Committee on Year 2000. The purpose of this committee 
is to share lessons learned and best practices in addressing the Year 2000 challenge, 
address cross-cutting issues affecting all government agencies and identify ways to 
manage resources in solving the Year 2000 problem. 

At SSA, we have used a systematic approach to making sure systems are Year 
2000 compliant. This approach consists of five phases: 

1 he Awareness phase, in which we defined the Year 2000 problem and ensured 
that everyone in SSA was aware of it; 

The Assessment phase, in which we identified our core business processes, ana- 
lyzed the systems supporting these processes, identified resources, and developed a 
detailed schedule for making corrections: 

The Renovation phase, in which we converted databases and are renovating soft- 
ware and modifying interfaces: 

The Validation phase, in which we are testing converted or replaced software: and 

The I mplementati on phase, in which we will implement converted or replacement 
systems. 

SSA has completed the first two phases as well as more than 90 percent of the 
renovation phase of its Year 2000 program. We are in the process of testing all of 
our renovated systems in our Year 2000 Test Facility. We are on schedule to com- 
plete testing of all systems by December 31, 1998, and to have all systems imple- 
mented into production in January 1999, providing a full year for post- 
implementation review. 

How IS SSA Progressing in Resolving its Year 2000 Problems? 

As of April 30, 1998, SSA has renovated more than 90 percent of the Agency's 
mission-critical systems. These mission-critical systems support our core business 
processes— enumeration, earnings, claims, postentitlement, and informing the pub- 
lic-through which we maintain the accuracy of beneficiary records and process and 
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adjudicate claims. SSA has also renovated 67 percent of its non-mission-critical sys- 
tems. All of SSA's systems are scheduled to be Year 2000 compliant by December 
of this year. 

In addition, we have taken an active role in addressing the issue of Year 2000 
compliance in case processing systems used by the State Disability Determination 
Services (DDSs) and data exchanges between SSA and other entities. 

Furthermore, SSA has developed plans to address the Year 2000 problem in the 
areas of our telecommunications and hardware infrastructure and facilities infra- 
structure. We have inventoried all components of these infrastructures and have 
plans in place to upgrade or replace all non-compliant equipment. We are working 
with the vendor community, the General Services Administration, and the CIO 
Council Committee on Year 2000 to test vendor fixes. 

What Obstacles Stand in the Way of the Completion of Preparations for 

Year 2000? 

In October, 1997, the General Accounting Office issued a report entitled, "Social 
Security Administration: Significant Progress Made in Year 2000 Effort, But Key 
Risks Remain." The report was generally very complimentary of SSA's Year 2000 
program: however, it identified three concerns— DDS systems compliance, data ex- 
changes, and contingency planning. At the time the report was issued we were ad- 
dressing all three areas and we continue to do so. 

DDS Software Compliance 

SSA has focused increased attention on ensuring that State DDS systems, which 
are used in determining the medical eligibility of disability applicants, are made 
Year 2000 compliant by December 1998. There are 55 DDSs: one in each of the 
States and the District of Columbia, Puerto Rico, Guam, and the Virgin Islands, as 
well as the Federal DDS at SSA Central Office in Baltimore. Since DDSs are fully 
funded by SSA, Year 2000 compliance activity costs in the DDSs were not borne by 
the States. 

We requested and received Year 2000 plans from each of the DDSs that identify 
specific milestones, resources, and schedules for completing Year 2000 conversion 
activities. All DDS systems are scheduled to be Year 2000 compliant by SSA's target 
of December 1998. As of today, twenty-one DDS systems have been renovated, test- 
ed and implemented. These DDSs are: Alabama, Arizona, Arkansas, Connecticut, 
Florida, Idaho, Indiana, Kentucky, Maine, Massachusetts, Michigan, Minnesota, 
New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Vermont, Washington DC, 
Wisconsin, and the Federal DDS. 

We are working closely with each DDS on monitoring and oversight of DDS Year 
2000 activities. SSA has a DDS Year 2000 Project Team working full time on DDS 
Year 2000 activities. Each DDS has named a Year 2000 Project Coordinator. In ad- 
dition, each SSA regional office has named a DDS Year 2000 Coordinator for the 
DDSs in that region. The SSA DDS Year 2000 Project Team and SSA's Year 2000 
Program Manager are in constant communication with the DDS Year 2000 Project 
Coordinators, Regional Office Coordinators, and State systems contractor represent- 
atives. The progress in each State continues to be monitored and tracked against 
project milestones in the State's Year 2000 plan. 

Since the majority of the DDSs (43) contract with one of two vendors for their sys- 
tems, SSA decided to enter into a contract with each vendor to cover all of the Year 
2000 conversion work for these 43 systems. This was done to enable Year 2000 con- 
version work to begin more rapidly and to allow SSA to exercise a greater degree 
of control to ensure the Year 2000 conversions are done timely. The DDSs which 
do not use these vendors' systems use either in-house systems, other vendor sys- 
tems, or are not automated. The States using other systems have all entered into 
contracts with their vendors, or planned for in-house changes to their systems, re- 
spectively. There are five DDSs that do not have automated claims processing sys- 
tems. 

We believe these actions and oversight activities, together with a close working 
relationship with the DDSs, will enable us to meet our schedule of making the DDS 
systems Year 2000 compliant by December 1998. 

Data Exchanges 

SSA has been actively addressing the issue of data exchanges which occur be- 
tween SSA and other Federal agencies. States, and third parties. We have inven- 
toried all of our external exchanges. In order to formally track the progress of each 
external data exchange, SSA developed the Data Exchange Tracking System 
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(DETS). SSA has just over 2,000 data exchanges with Federal agencies, States, or 
third parties. For example, SSA exchanges data with the Treasury Department to 
make benefit payments and with the States to verify death records. 

We have been in contact with all of our trading partners regarding the format and 
schedule for making these data exchanges compliant. Thus far, 65 percent of our 
data exchanges have been made Year 2000 compliant and implemented. We are in 
the process of negotiating, scheduling, and implementing remaining changes. Our 
target is to have all data exchanges implemented by December 1998. 

We are focusing particular attention on our exchanges which affect benefit pay- 
ments. We are working very closely with the Treasury Department to ensure Social 
Security and Supplemental Security Income (SSI) checks and direct deposit pay- 
ments for J anuary 2000 will be on time. The testing plans for Social Security and 
SSI payments have been approved by SSA and Treasury. J oint testing of files began 
on March 4, 1998, and testing is going as planned. In addition to testing with Treas- 
ury, we have agreements to test from SSA, through Treasury and the Federal Re- 
serve's automated clearinghouse, for direct deposit payments. 

Contingency Planning 

On March 31, 1998, we issued the SSA Business Continuity and Contingency 
Plan. The plan addresses the core business functions, including disability claims 
processing functions supported by the DDSs, which must be supported if Year 2000 
conversion activities experience unforeseen disruptions. The plan identifies potential 
risks to business processes, ways to mitigate each risk, and strategies for ensuring 
continuity of operations if planned corrections are not completed or if systems fail 
to operate as intended. The plan, which also identifies milestones, target dates, and 
responsible components for developing local contingency plans and procedures 
throughout all of SSA’s operating components, will be updated quarterly and used 
to track development and testing of local contingencies planned throughout the 
agency. 

We certainly hope that there will be no need to activate the SSA Business Con- 
tinuity and Contingency Plan. Flowever, if there are unforeseen. Year 2000-induced 
disruptions, this contingency plan will be implemented to ensure continuation of 
SSA 's vital services to the public. 

Will SSA's Data Systems Be Ready for the Transition to the New 

Millennium? 

There is no question that the Year 2000 problem is the biggest challenge ever fac- 
ing the information technology industry. Since SSA is so dependent on computers 
to do its business and serve the public, we have taken this problem very seriously 
and dedicated the resources to address it in a timely manner. 

Because of our early attention to this challenge, we are confident that our systems 
will function on and after the Year 2000 to ensure that our core business processes 
proceed smoothly and without disruption as we move into the 21st century. When 
we open our offices for business on J anuary 3, 2000, we expect to be prepared to 
provide our full complement of services to the American public with the accuracy 
and reliability they have come to expect from SSA. And, if there are unforeseen 
problems, we will have contingency plans in place to assure continuity of SSA's busi- 
ness operations. 

I would be happy to answer any questions you may have. 


Chairman J ohnson of Connecticut. Thank you very much. 

Mr. Fiyzik. 

STATEMENT OF JAMES J. FLYZIK, DEPUTY ASSISTANT 
SECRETARY FOR INFORMATION SYSTEMS; AND CHIEF 
INFORMATION OFFICER, U.S. DEPARTMENT OF THE 
TREASURY 

Mr. Flyzik. Madam Chairman, Representative Coyne, and Mem- 
bers of the Subcommittee, thank you very much for the opportunity 
to appear today to discuss the Department of Treasury's progress 
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on year 2000. I request that my complete written testimony be sub- 
mitted for the record. I 'll summarize here for the sake of time. 

The Department has indicated that the year 2000 computer prob- 
lem is our highest priority information technology challenge, and I 
am confident that Treasury has a strong program in place to ad- 
dress this challenge. While there is much work ahead of us, we 
have made significant progress to date. The Assistant Secretary for 
Management and Chief Financial Officer has the overall respon- 
sibility for year 2000. As the Deputy Assistant Secretary of Infor- 
mation Systems and Chief Information Officer, I am the overall 
program manager for this effort. Day-to-day responsibilities reside 
in my office. We have contracted with several firms with special- 
ized skills to assist us with our effort. Attached to my submitted 
written statement is a chart that shows how we're organized to ad- 
dress this problem. 

The Secretary of the Treasury himself is briefed periodically by 
me on the status of our program, and the Assistant Secretary for 
Management and Chief Financial Officer, and myself meet every 
week with the bureaus to review their progress. We have working 
groups that meet regularly for information technology, noninforma- 
tion technology, and telecommunications components and, our bu- 
reaus submit monthly reports to me. 

We've identified 323 mission-critical IT systems and 269 mission- 
critical non-IT systems. At present, we have renovated 133, or 55 
percent, of the mission-critical systems that need to be converted. 
We can now report 125 out of 323 of the total mission-critical IT 
systems are year 2000 compliant. 

The TCS, Treasury Communications System, as mentioned by 
Commissioner Rossotti, is a nationwide data network serving all 
Treasury bureaus and many other Federal agencies. The TCS as 
we call it, provides multiple services and is the largest secure, pri- 
vate wide-area network in the U.S. civilian government. We have 
established a test laboratory where each component of this network 
can be tested both as an independent system and from an inter- 
operability perspective as each component is interconnected with 
the other components. As Mr. Rossotti testified, we formed a com- 
bined program management team which brings all the individuals 
associated with this program together to work with our contractors 
in one location. We are coordinating issues with the manufacturer 
of each piece of equipment and software incorporated in our net- 
work, and we expect to be in a position by September 30, 1998, to 
be year 2000 compliant. 

In order to address these challenges, we also have established a 
command center to serve as our central location for telecommuni- 
cations activities, including our executive body and working group 
meetings. Charts and graphs that depict the current status of hard- 
ware and software for each corporate program, the independent 
verification and validation testing process, and progress tracking 
are displayed prominently for use by program managers and execu- 
tives. 

To further promote communications among my offices, executive 
body, program areas, working groups, and our bureaus, we have es- 
tablished a telecommunication site on our year 2000 Internet Web 
site. We have engaged a telecommunications company to perform 
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independent verification and validation of all of our infrastructure 
components with respect to year 2000 compliance. 

As of March 6, 1998, we have identified 6,898 external data ex- 
changes of which 3,169 are incoming, and 3,729 are outgoing. The 
Department has assessed 99.7 percent of these external data ex- 
changes and found that 87 percent are year 2000 compliant or have 
been granted a waiver. Of the 2,551 interfaces with the U.S. pri- 
vate sector. Treasury bureaus and offices thus far have contacted 
2,446 and reached agreements with 2,391. In our regulatory and 
oversight roles, the Office of Thrift Supervision and the Office of 
the Comptroller of the Currency are participating with the Federal 
Financial Institutions Examination Council in aggressive programs 
to audit the financial institutions compliance on year 2000. 

I n early 1996, we established September 1998 as a program mile- 
stone for completion of contingency plans. During a series of meet- 
ings with bureau and office heads in J une 1997, the Department 
emphasized the need for contingency planning. 

In spite of our best efforts to date, and our aggressive plans for 
the future, the year 2000 is far from solved. Indeed, several key 
significant issues pose special challenges for us and possibly for 
other agencies as well. One issue that concerns us is vendor sched- 
ules for year 2000 compliant versions of their commercial off-the- 
shelf hardware and software products. As Mr. Rossotti indicated, 
we have a large number of products in our networks. Some vendors 
have yet to release year 2000 compliant upgrades. 

While we are continuing to work on our renovation efforts, our 
testing cannot be complete until we have obtained and integrated 
the year 2000 compliant third-party versions of these products. In 
addition to funding challenges, we must also contend with the in- 
creasing rate of attrition within our information systems work 
force. Skilled programmers, especially those with experience in leg- 
acy system platforms, are in strong demand within the private sec- 
tor which can pay significantly higher salaries than the govern- 
ment. 

I believe that Treasury has an aggressive overall year 2000 pro- 
gram in place and we are on target to complete the conversion, 
testing, validation, and implementation of all mission-critical sys- 
tems in time to avoid disruptions to any of these critical systems. 
Nothing less than 100 percent compliance will be acceptable to the 
American public and to me personally. 

Thank you for the opportunity to meet with you today to discuss 
the actions being taken by the Department of the Treasury. I will 
be happy to answer questions you may have on this important mat- 
ter. 

[The prepared statement follows:] 

statement of J amesj . Flyzik, Depu^ Assistant Secretary for Information 

Systems; and Chief Information Officer, U.S. Department of the Treasury 

Chairwoman J ohnson, Representative Coyne, and members of the Subcommittee, 
thank you for the opportunity to appear today to discuss the Department of the 
Treasury's progress on the Year 2000 computer probiem. The Department of the 
Treasury has stated that the Year 2000 computer probiem is our highest priority 
information technoiogy chaiienge. i am confident that Treasury has a strong pro- 
gram in piace to address this chaiienge, and whiie there is much work ahead of us, 
we have made significant progress to date. 
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The Assistant Secretary for Management and CFO has overall responsibility for 
the Year 2000 date transition. As Deputy Assistant Secretary (Information Systems) 
and CIO, I am the overall program manager for the Year 2000 effort. The day-to- 
day responsibilities of the Year 2000 program reside within my office. In addition, 
Treasury has contracted with several firms with specialized skills in the Year 2000 
problem, and these firms are assisting the Department in its oversight role. At- 
tached to this statement are copies of the Year 2000 Program Organization at the 
Department of the Treasury. 

Secretary of the Treasury Rubin is briefed periodically on the status of our Year 
2000 program, and the Assistant Secretary for Management and CFO and myself 
meet weekly with bureau heads to review their Year 2000 progress. Working groups 
meet regularly for the IT, Non-IT, and Telecommunications components of our pro- 
gram. The Department requires each bureau and office to submit detailed monthly 
status reports. Additionally, the Secretary of the Treasury has mandated that each 
bureau and office head select an executive official to be in charge of their Year 2000 
program. This individual, typically at the CIO or CFO level or higher, is responsible 
for ensuring that the Year 2000 program at their bureau or office is completed in 
a timely manner. I would now like to describe the overall status of Treasury's Year 
2000 program, some successes we have experienced, and some remaining challenges 
we must address. 

Treasury has identified 323 mission critical IT systems and 269 mission critical 
Non-IT systems. At present, we have renovated 133, or 54.7% of the mission critical 
IT systems that need to be converted. We can now report 125 out of 323 (38.7%) 
of the total mission critical IT systems are now Year 2000 compliant. 

I believe that, as a Department, we have made significantly more progress than 
has been indicated by the above figures. We are conservatively not reporting 
progress until enti re systems have been renovated and tested. For example, the Cus- 
toms Service, like the IRS, manages its renovation efforts by components. Customs 
has three mission critical systems, all of which require repair, which included 186 
components. Although we report none of these three Customs mission critical IT 
systems as completed renovation, testing, or implementation, the fact is that 68.5% 
of the components within these systems have been renovated, 35.3% have been test- 
ed, and 25% have been implemented. 

Treasury operates one of the largest enterprise telecommunications networks in 
the Government. This Treasury Enterprise System includes both local and nation- 
wide telecommunications systems. My office is directly responsible for theYear 2000 
compliance of these telecommunications systems. 

The Digital Telecommunications System (DTS) is an integrated voice/data local 
telephone system in over 30 Treasury locations that serves over 30,000 Treasury 
employees. Treasury has established a phased implementation schedule so that DTS 
will be Year 2000 compliant by September 1998. 

The Treasury Communications System (TCS) is a nationwide data network serv- 
ing all Treasury bureaus and some Federal agencies (such asj ustice). TheTCS pro- 
vides multiple services and is the largest secure, private wide-area network in the 
U.S. civilian Government. We have established a test laboratory where each compo- 
nent of the TCS network can be tested, both as an independent system, and from 
an interoperability perspective as each component is interconnected with other com- 
ponents. Treasury is coordinating the Year 2000 issues with the manufacturer of 
each piece of equipment and software incorporated in the TCS network and expects 
to be operationally Year 2000 compliant on or before 30 September 1998. 

In order to address these challenges, a Year 2000 Telecommunications "Command 
Center" has been established to serve as a central location for telecommunications 
activities, including the Telecommunications Executive Body and Working Group 
meetings. Charts and graphs depicting current hardware and software status of 
each corporate telecommunications program, the independent verification and vali- 
dation (IV&V) testing process, and overall progress tracking are displayed promi- 
nently for use by program managers and executives. To further promote communica- 
tions among the CIO, Executive Body, program areas, working groups and bureaus, 
the Department has established a telecommunications site on the Treasury Year 
2000 Intranet web site. In addition. Treasury has engaged a telecommunications 
company to perform independent verification and validation (IV&V) of the tele- 
communications infrastructure with respect to Year 2000 compliance. 

Since the kickoff of the Treasury Non-IT Working Group on August 28, 1997, 
Non-IT efforts have been continuing. The management planning and the definition 
of bureau and office specific Treasury Year 2000 Non-IT management plans began 
on October 16, 1997. These plans are based on the standard plan format, overall 
process, and content requirements as defined in the Treasury Year 2000 Non-IT 
Baseline Management Plan, dated October 16, 1997. This Treasury plan has been 
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used as a model by the General Services Administration (GSA) for addressing Non- 
IT systems. 

The Non-IT effort Is supported by a central Non-IT database, on the Treasury 
1 ntranet Year 2000 site, which provides a tracking tool to determine the compliance 
status of vendor products. 

As of March 6, 1998, Treasury bureaus and offices had Identified 6,898 external 
data exchanges, of which 3,169 were Incoming and 3,729 were outgoing. The Depart- 
ment has assessed 6,878 out of 6,898 (99.7%) of these external data exchanges, and 
found that 87.3% are Year 2000 compliant or have been granted a waiver. Of the 
2,551 Interfaces with the US private sector. Treasury bureaus and offices thus far 
have contacted 2,446 and reached agreements with 2,391. 

In our regulatory and oversight roles, the Office of Thrift Supervision (OTS) and 
the Office of the Comptroller of the Currency (OCC) are participating on the Federal 
Financial Institutions Examinations Council (FFIEC) with aggressive programs to 
audit financial Institutions' compliance on Year 2000. 

At the Department level, coordination on Year 2000 data exchanges has been on- 
going with other government agencies. Treasury has held a series of meetings with 
executives and staffs from the Department of Defense and the Department of Agri- 
culture's National Finance Center to address and resolve data exchange Issues and 
readiness for Year 2000 testing. 

In early 1996, Treasury established September 1998 as a program milestone date 
for the completion of contingency plans. During a series of meetings with bureau 
and offices heads In J une 1997, the Department emphasized the need for contin- 
gency planning and asked the bureaus and offices to accelerate their schedules for 
the development of these plans. Since then. Year 2000 Contingency Management 
Plans have been developed at several bureaus and offices for mission critical IT sys- 
tems and components. Factors such as failure date, time to Implement, depend- 
encies, Interfaces, resources, responsible office. Impact, and criteria for Invoking the 
plans are Included. The bureaus' and offices' contingency planning efforts will be ex- 
panded to address Non-IT mission critical systems and telecommunications Items. 

In spite of our best efforts to date and our aggressive plans for the future, the 
Year 2000 problem Is far from solved. Indeed, several significant key Issues pose 
special challenges for us, and possibly for other Government agencies as well. 

One Issue that concerns us Is vendor schedules for Year 2000 compliant versions 
of their commercial off-the-shelf hardware and software products. Some vendors 
have yet to release Year 2000 compliant upgrades of their products. While we are 
continuing to work on our renovation efforts, our testing cannot be completed until 
we have obtained and Integrated the Year 2000 compliant third-party versions of 
these products. 

Treasury's cost estimates for fixing the Year 2000 computer problem have contin- 
ued to rise. In our submission to 0MB for the February 15, 1998, report, we esti- 
mated a total cost of $1.43 billion, with the bulk of that cost being Incurred In this 
fiscal year. Our cost estimates were Initially based In large part on a Year 2000 cost 
model that focused on costs associated with mainframe lines of code. In the period 
si nee those Initial estimates were provided. Treasury bureaus and offices have made 
significant progress In their Inventory and cost estimate efforts for repairing and 
testing IT Items, telecommunications Items, and Non-IT Items. In the February 15, 
1998, quarterly report, we estimated Non-IT program costs of $68.6 million, and 
$295 million for telecommunications costs. 

In addition to funding challenges, we must also contend with the Increasing rate 
of attrition within our Information systems workforce. Skilled programmers— espe- 
cially those with skills In legacy system platforms— are In strong demand within the 
private sector, which can pay significantly higher salaries than the Government. 

1 believe that Treasury has an aggressive overall Year 2000 program In place, and 
we are on target to complete the conversion, testing, validation, and Implementation 
of all mission critical systems In time to avoid disruption to any critical systems. 
Nothing less than 100% compliance will be acceptable to the American public, or 
to me personally. 

Thank you for the opportunity to meet with you today to discuss the actions being 
taken by the Department of the Treasury In addressing the Year 2000 computer 
problem. 1 will be happy to answer any questions you may have regarding this Im- 
portant matter. 
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Chairman J ohnson of Connecticut. Thank you very much. 

Ms. Craig. 

STATEMENT OF CONSTANCE E. CRAIG, ASSISTANT COMMIS- 
SIONER, INFORMATION RESOURCES, FINANCIAL MANAGE- 
MENT SERVICE, U.S. DEPARTMENT OF THE TREASURY 

Ms. Craig. Good morning. Thank you for the opportunity to ap- 
pear today. The highest priority of the Finandai Management 
Service is to adapt our mission-criticai computer systems to the 
century date change. FMS is devoting aii possibie resources to en- 
sure that the day-to-day services we provide to the American peo- 
pie wiii not be disrupted after] anuary 1 of the year 2000. 

FMS piays a centrai and criticai roie within the government. Vir- 
tuaiiy every Federai agency depends on FMS to fadiitate the 
issuance of payments, coiiection of revenue and deiinquent debt, 
and account for the government's receipts and outiays. Each fiscai 
year we issue over 850 miiiion payments with a doiiar vaiue of 
more than $ltriiiion. We issue these payments on behaif of civiiian 
agencies, such as the Sociai Security Administration, the Depart- 
ment of Veterans Affairs, and iRS. FMS aiso provides debt coiiec- 
tion services and manages the processing of roughiy $1.4 triiiion in 
Federai revenue. FMS aiso maintains the centrai accounting and 
reporting systems that track the government's monetary assets and 
iiabiiities. 

in terms of current status, we have turned a corner and gained 
momentum since the beginning of this year. We are now weii un- 
derway with making the necessary changes to our software code 
and aii but 3 of our 62 mission-criticai systems are scheduied for 
compietion by the end of 1998. The remaining three systems wiii 
be impiemented in eariy to mid 1999. We are confident that we wiii 
compiete aii of the necessary work to ensure compiiance before the 
beginning of the year 2000. 

As an exampie, we have made criticai progress with the Sociai 
Security Administration to ensure that monthiy direct deposits and 
check payments wiii continue to go out accurateiy and on time 
after J anuary 1 of the year 2000. Our Phiiadeiphia office and the 
Sociai Security Administration have been working cioseiy together 
to coordinate the required program and format changes needed for 
Y2K compiiance. As Mr. Dyer indicated, testing between Sociai Se- 
curity and FMS began in March. We wiii compiete that testing in 
J uiy, and impiement Y2K compiiance systems for both Sociai Secu- 
rity and Suppiementai Security income payments in August. Based 
on the fact that our testing wiii be compieted at ieast 15 months 
before the year 2000 deadiine, we beiieve we can be confident that 
aii Sociai Security payments wiii be issued correctiy and on time 
by FMS when the century begins. 

i n addition to renovating and testing our criticai systems, we are 
taking steps to mitigate risks by focusing extra attention on data 
exchange, certification, and contingency pianning. FMS interfaces 
with aimost every Federai program agency. We beiieve we can re- 
duce risks by minimizing the interface changes needed for success- 
fui data exchange. For many of our systems we are not requiring 
agencies to change fiie formats or adopt a four-digit year. Our as- 
sessment indicated that these systems wouid continue to function 
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beyond the year 2000 without using a four-digit date. Our analysis 
also indicated that it would require less time and effort to ensure 
compliance if date and file formats remained the same. As a result, 
we are not changing those formats, rather, these systems are being 
internally modified to distinguish between the years 1900 and 
2000 . 

With regard to certification, we have developed procedures which 
include baseline testing, simulated forward date testing, and some 
actual forward date testing. We are also employing a contractor to 
provide independent review and validation of test results for each 
internal mission-critical system prior to certification. 

To further address the challenges and risks of Y2K, we are devel- 
oping contingency plans to ensure that a basic level of service can 
be provided as disruptions cxcur. This includes identification of spe- 
cific risks and asscxiated mitigation strategies. As an example, if 
there are Icxal power outages, we will move the work to one of our 
centers that has continucxis backup power capability. We are put- 
ting a significant amount of effort into this planning because we do 
touch the lives of so many Americans, and we expect to complete 
the contingency planning prcxess before the end of the summer. 

FMS views systems preparation for the year 2000 as our absolute 
highest priority and we will assign whatever resources are needed 
to ensure we do not fail. 

Thank you for allowing me the opportunity to discuss our plans 
to meet the year 2000 challenge. I would be happy to answer any 
questions you may have regarding this issue. 

[The prepared statement follows:] 

statement of Constance E. Craig, Assistant Commissioner, Information 

Resources, Financial Management Service, U.S. Department of the 

Treasury 

Chairwoman J ohnson, and members of the Subcommittee, thank you for the op- 
portunity to appear today to discuss the Finandai Management Service's (FMS) 
progress in meeting the chaiienges posed by the year 2000 (Y2K) computer probiem. 
In my capacity as Assistant Commissioner of Information Resources, I have the re- 
sponsibiiity for making the program decisions to ensure that FMS computer systems 
areY2K compiiant. 

The highest priority of the Finandai Management Service is to adapt its mission 
criticai computer systems to the century date change. FMS is devoting aii possibie 
resources to ensure that the day-to-day services we provide to the American peopie, 
on behaif of other Federai agencies, wiii not be disrupted on January 1, 2000 or 
thereafter. 

FMS pi ays a centrai and criticai role within the government. Virtually every Fed- 
eral agency depends on us to facilitate the issuance of payments, collection of reve- 
nue and delinquent debt, and accounting for the government's receipts and outlays. 
Each fiscal year, FMS issues over 850 million payments, with a dollar value of more 
than $1 trillion. We issue these payments on behalf of civilian agencies such as the 
Social Security Administration, the Department of Veterans Affairs, and the Inter- 
nal Revenue Service. Our payment services touch the lives of over 100 million peo- 
ple, and literally tens of millions of Americans depend on FMS systems to meet life- 
line needs every month. FMS also provides debt collection services and manages the 
processing of roughly $1.4 trillion in Federal revenues, which include corporate and 
individual income taxes, customs duties, and Federal fines. And, FMS maintains the 
central accounting and reporting systems that track the government's monetary as- 
sets and liabilities, 7,500 separate Congressionally enacted accounts in all. Making 
sure our systems are year 2000 compliant is absolutely essential to our operations 
and the integrity of our systems for paying, collecting and accounting for money gov- 
ernment wide. 

To make the necessary modifications to our automated systems for the century 
date change requires a massive, all out effort that touches every part of FMS. It 
is our number one priority effort and we are well underway with making the 
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changes to our software code to have our systems in compliance. I have attached 
several charts to my testimony that show the status of FMS's 62 mission critical 
systems. SinceJ anuary, we have implemented three replacement systems and com- 
pleted repair on two systems requiring renovation, bringing to 15 the number of 
Y2K compliant mission critical systems. In addition, of the 38 systems still in need 
of repair, we have completed assessment on 33, 22 of which are now in the renova- 
tion phase, and 11 of which are in validation testing. Implementation of Y2K com- 
pliant systems for all but three of our mission critical systems is planned, and on 
schedule, for completion by the end of 1998. The remaining three will be imple- 
mented in early to mid-1999. We are confident that we will complete all necessary 
work to ensure compliance well beforej anuary of the year 2000. 

For example, we have made critical progress with the Social Security Administra- 
tion (SSA) to ensure that monthly direct deposit and check payments will continue 
to go out accurately and on time after J anuary 1, 2000. Social Security disburse- 
ments comprise almost two-thirds of our overall payment volume. Each month, FMS 
issues 33 million electronic funds transfer/direct deposit payments and 17 million 
check payments to Social Security recipients. The majority of these payments are 
issued by our Philadelphia Regional Financial Center. 

The FMS Philadelphia office and the Social Security Administration have been 
working closely together to coordinate the required program and format changes 
needed for Y2K compliance. All of the programming changes necessary to begin Y2K 
validation have been completed, and testing between SSA and FMS began in March. 
Testing will be accomplished through all Social Security and FMS processes, includ- 
ing the transmission of input from the Social Security Administration to FMS, proc- 
essing of that information in FMS's payment system, end to end testing from the 
payment system to FMS claims and accounting systems and the Federal Reserve, 
and transmission of output back to SSA. Validation will also be accomplished using 
both current and forward date testing. We will complete all of our testing by J uly, 
and implement Y2K compliant systems for both Title II (old age and survivors bene- 
fits) and Title XVI (supplemental security income) payments in August. Based on 
the fact that our testing will be completed at least 15 months before the year 2000 
deadline, we can be confident that all Social Security payments will be issued cor- 
rectly and on time by FMS when the next century begins. 

In addition to renovating and testing our critical systems, we are taking steps to 
mitigate the risks to our mission and the American people by focusing extra atten- 
tion on data exchange, certification and contingency planning. Because almost every 
Federal program agency exchanges data with us, we are minimizing the amount of 
change needed to interface with our systems wherever possible. For the majority of 
the FMS payment, accounting and claims systems, we are not requiring agencies 
to change file formats or to adopt a four digit year. Our Analysis indicated that 
these systems could continue to function b^ond the year 2000 without using a four 
digit date, and that it would require less time and effort to make the changes need- 
ed to ensure compliance if formats did not change. The majority of the agencies 
interfacing with these systems have also indicated that it would facilitate their con- 
version efforts if date and file format requirements do not change. Consequently, we 
are not changing these file formats, rather our systems are being internally modi- 
fied to distinguish between the year 1900 and the year 2000. FMS has established 
a Web page and issued a number of Treasury Financial Manual bulletins, to provide 
guidance on these issues. We are also meeting regularly, and working closely, with 
our major data exchange partners to ensure we have a common understanding on 
date standards, file formats and testing schedules. 

With regard to certification, procedures have been developed which include base- 
line testing, simulated forward date testing and actual forward date testing. A con- 
tractor will be employed to provide independent review and validation of test results 
for each internal mission critical system, and make recommendations for re-testing 
or certification based on that review. If re-testing is necessary, they will provide spe- 
cific guidance on necessary steps to fix identified problems and achieve successful 
validation testing. Certification is scheduled for completion on all but one of our sys- 
tems, by March of 1999; the remaining system will be certified by J une of 1999. Post 
implementation reviews will be conducted during the rest of 1999. 

Although these efforts will greatly reduce the chance of a systems failure, there 
will still be areas of risk as FMS depends on vendors for telecommunications and 
software services, and public infrastructure services for power and transportation. 
To address these challenges, we are also developing contingency plans so that, in 
the event there are Y2K related disruptions, a basic level of service can be provided 
to F M S customers and the Public until normal service can be restored. This includes 
identification of specific risks and associated mitigation strategies. As examples, if 
we experience data communications problems in one area, we could route the work- 
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Iced to another center; or if there are local power outages, we could move the work- 
load to a center with backup power capabilities. Because FMS touches the lives of 
so many Americans, we are doing everything we can to ensure that our critical busi- 
ness services will not be interrupted. Completion of contingency plans is targeted 
for this summer. 

We view systems preparation for the year 2000 as our absolute highest priority, 
enabling us to successfully maintain payment and collection operations in the next 
century. FMS will assign whatever resources are needed to ensure we do not fail 
to accomplish these changes to our computer systems. 

Thank you for allowing me the opportunity to discuss FMS's plans to complete 
the work necessary to enable us to meet the year 2000 computer challenge. We rec- 
ognize the importance and enormity of the challenge and are working to ensure that 
important government services are not disrupted on January 1, 2000. I would be 
happy to answer any questions you may have regarding this issue. 
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Chairman Johnson of Connecticut. Thank you very much, Ms. 
Craig. 

Ms. Goeri. 

STATEMENT OF VINCETTE L. GOERL, ASSISTANT COMMIS- 
SIONER, OFFICE OF FINANCE; AND CHIEF FINANCIAL 

OFFICER, U.S. CUSTOMS SERVICE 

Ms. Goerl. Good morning, Madam Chairman, and Members of 
the Subcommittee, it is a pieasure to appear before you to present 
Customs' approach to managing the year 2000 renovation effort 
and how the year 2000 wiii affect Customs' major program areas 
in fuifiiiing our commitment to deiiver safe borders for the Amer- 
ican peopie. With your permission, i wouid iike to submit my for- 
mai statement for the record and briefiy address some of the issues 
of interest to the Subcommittee. 

Everything i wiii discuss with you today revoives around Cus- 
toms' commitment to ensuring that the transition to the next mii- 
iennium wiii move smoothiy with minimai disruption to trade and 
iaw enforcement activities. Customs interfaces with miiiions of peo- 
pie, commerdai organizations, and nationai and internationai orga- 
nizations through, or in conjunction with other computer and other 
systems. 

Three mission-criticai systems support Customs' efforts, the 
Automated Commerdai System processes over $850 biiiion in im- 
ported merchandise and accounts for the coiiection of $21 biiiion in 
revenue. The Treasury Enforcement and Communications System 
assists in the processing of over 450 miiiion passengers annuaiiy 
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through the U.S. borders. The Administrative and Management 
System provides for Customs accounting functions, human resource 
management activities, payroll activities, and various other admin- 
istrative functions. The failure of these mission-critical systems to 
be in compliance with the year 2000 change could have a substan- 
tial impact on Customs programs. Customs compliance laws would 
have to be manually ensured which would cost the U.S. Treasury 
millions of dollars in fines, fees, and penalties. For our trading 
partners, the release of cargo would be delayed as millions of en- 
tries would have to be manually processed. This would cause a fun- 
damental slowdown in trade and hinder the ability of businesses to 
provide their goods to their customers. 

Customs law enforcement activities rely on accurate and up-to- 
date data. Inspectors rely on this data to make informed decisions 
as to which shipment to review resulting in possible loss of reve- 
nue. The Customs Treasury Enforcement and Communications 
System, or TECS, provides a large database of law enforcement 
data which interfaces with other Federal and State law enforce- 
ment systems and provides integral information for border oper- 
ations. Without TECS, intelligence, alerts, and lookouts could be 
lost and we could see an increase in the smuggling of narcotics and 
other prohibited merchandise, money laundering, and commercial 
fraud. 

Our traveling public could also be adversely affected if the sys- 
tems should fail due to year 2000 related problems, as advanced 
passenger information used for targeting high-risk passengers may 
be unavailable. This could result in more passengers being inter- 
viewed and more luggage searched causing congestion and backups 
at international processing facilities. With systems conversion prob- 
lems, Customs could also be looking at manually processing checks, 
the majority of such payments now being made electronically. 

In order to ensure that these program nightmares do not occur. 
Customs developed a comprehensive year 2000 program in 1997 in 
conformance with the General Accounting Office guidelines to ad- 
dress the efforts required to bring information technology systems 
and non-IT systems activities in conformance with year 2000 re- 
quirements. An executive council, composed of senior Customs 
managers, was formed to provide oversight to the program. A sys- 
tematic approach was developed to address the year 2000 chal- 
lenges. Detailed plans were developed to guide the year 2000 ef- 
forts through each step of the process in conformance with the 
GAO requirements and 0MB mandates. Contingency plans also 
have been developed to address mission-critical computer systems 
in the event of major systems failures. Contingency plans are in 
process to address non-mission-critical computer systems, computer 
operating systems, and telecommunications. 

I'm happy to report that Customs is on schedule to meet target 
dates established by the year 2000 program plan. To date, of the 
21 million lines of code associated with mission-critical systems, 88 
percent have been renovated, 60 percent have been tested, and 37 
percent are back in production. 

For the non-IT items, we are continuing our assessment of build- 
ing systems by reviewing the FI -back systems, elevators, and secu- 
rity. Our plans call for the LAN and personal computers to be as- 
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sessed, tested, and brought into year 2000 conformance by either 
making modifications or replacement of the equipment. Of the over 
4,300 other non-IT products we have assessed in our inventory, 67 
percent do not have a date functionality. Of the products with date 
function, 93 percent are year 2000 compliant. Our next steps in the 
non-IT area will be to validate the products, oversee the renova- 
tions, and develop product-specific test plans and execution strate- 
gies. By October 1, 1998, all mission-critical and non-mission-criti- 
cal systems are to be in production to allow for the full fiscal year 
of operations for the year 2000. By March 31, 1999, all non-IT sys- 
tems are to be in production. 

The cost to complete the year 2000 renovation is estimated at 
$122 million. These costs represent the estimated expenditures 
from project conception to completion, that is, for fiscal 1997 
through the year 2000. Of this amount, $34 million relates to the 
three mission-critical systems, and $50.5 million relate to non- 
applications such as personal computers, mainframe upgrades and 
infrastructure. 

I n closing, I would like to say that although we have made much 
progress in year 2000 efforts. Customs' year 2000 program ap- 
proach has provided long-term benefits beyond the year 2000 con- 
version. This approach has allowed us to take positive steps toward 
guiding application inventory, central repository, standard metrics 
for measuring performance, and contingency planning. We realize 
that there's not much left to be done. However, we will continue 
to follow our Y2K project approach and move toward our imple- 
mentation goals. We look forward to working with the Subcommit- 
tee to accomplish year 2000 conversion efforts. 

Thank you. Madam Chairman. I would be pleased to answer any 
questions. 

[The prepared statement follows:] 

statement of Vi ncette L. Goerl, Assistant Commissioner, Office of Finance; 
and Chief Financial Officer, U.S. Customs Service 

Good morning, Madam Chairman and Members of the Subcommittee. I am 
pieased to be here today and present Customs approach to managing the Year 2000 
renovation efforts, the status of our efforts and how our efforts wiii affect Customs 
major program areas. Aithough the originai mission of Customs was to coliect reve- 
nue, its roie inciudes guarding and protecting the nations's borders. Customs inspec- 
tors at the borders are the nation's first iine of defense against iiiegai drugs, tainted 
or deseased food and piant products, unsafe or counterfeit goods, iiiegai weapons, 
other types of contraband, chiid pornography, finandai crimes and money iaunder- 
ing. It is important for Customs to process passengers and cargo quickiy and effi- 
cientiy but aiso to ensure that sufficient vigiiance and care are exercised to detect 
and intercept noncompiying persons and substances. 

To ensure that Customs pursues its mission effectiveiy and efficientiy, three mis- 
sion criticai systems are used. The Automated Commerdai System processes over 
$850 biiiion in imported merchandise and accounts for the coiiection of $21 biiiion 
in revenue. The Treasury Enforcement and Communications System assists in the 
processing of over 450 miiiion passengers annuaiiy through the U.S. borders. The 
third system, the Adminstrativ^Management System provides for Customs account- 
ing functions, human resource management activities, payroii activities and various 
other administrative functions. Within Customs, neariy 21 miiiion iines of code must 
be reviewed as a part of the Y2K efforts for these mission criticai systems. Without 
renovation to these systems, coiiections after December 31, 1999, cannot be depos- 
ited for any previous dates; aierts, iookouts and inteliigence wouid be iost; and pay- 
ments to creditors and empioyees wouid be deiayed or incorrect. Y2K non-IT efforts 
require among many things that 340 LANs and 19,000 personai computers be 
brought into compiiance, and for iaboratory equipment to be tested and upgraded 
as necessary. 
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Program Impact 

Customs interfaces with miiiions of peopie, commericai organizations and nationai 
and internationai governmentai organizations. Much of this interface is through or 
in conjunction with computer and other systems. As a resuit, the faiiure of these 
systems to be in compiiance with the century change, wouid criticaiiy impact com- 
merce and iaw enforcement in the United States. 

United States Citizenry 

The United States Customs compiiance iaws wouid have to be manuaiiy enforced 
which couid cost the United States Treasury miiiions of doliars in fines, fees and 
penaities. In addition, coliections couid be further impacted shouid post Year 2000 
dates resuit in incorrect interest and aging caicuiations. 

Trading Partners 

Our goai for our Trading Partners is to ensure the reiease of cargo wiii not be 
deiayed. The neariy 1.5 miiiion entries, most of which are automaticaiiy released, 
would have to be manually processed. Delays up to a week or more could occur. This 
could cause a fundamental slow down in trade and hinder the ability of businesses 
to provide their goods to their customers. For instance, businesses with "just-in- 
time" inventories will have tremendous problems conducting normal activities. Addi- 
tionally, shipments with perishable goods could see spoilage causing potentially tre- 
mendous losses before the entries are processed and the goods are releasable into 
the economy. 

Brokers, importers, port authorities and others currently have direct access to cer- 
tain public Customs computer files— primarily entry summary type of data. Quali- 
fied users can now monitor and track product entries by use of such tools as infor- 
mation queries, paper less electronic updates and messaging. Tariff, quota status 
and cargo release data are just some types of data available to qualified system 
users which would no longer be available, in the event of system failures. The im- 
pact of not being able to provide this access would not only mean delays in process- 
ing import information but also would burden Customs staffing and may result in 
less compliance enforcement, as well as less accurate revenue information. 

The trade community would suffer further should there be a failure to the sys- 
tems that the air, sea, rail and truck carriers use to assist them in reconciling their 
cargo inventories. The reconciliations are necessary as th^ lead to better manage- 
ment of carriers billing, accounting and traffic control functions. 

U.S. Law Enforcement Organizations 

For most U.S. Law Enforcement Organizations, enforcement or compliance laws 
would be in jeopardy if the automated processes used to assist Customs Inspectors 
in determining which shipments to review is not functioning properly. As a result, 
the review process would be based solely on the Inspectors' intuitive analyses. This 
could lead to loss of revenue in the form of fines, fees, penalties and seizures. 

The Customs T reasury Enforcement and Communications System provides a large 
database of law enforcement data which interfaces with other Federal and State law 
enforcement systems. The system supports other agency border operations, for ex- 
ample, the Immigration and Naturalization Service. Without this system, intel- 
ligence, alerts, and lookouts would be lost or not available on a timely basis. Law 
Enforcement agencies may not be able to detect criminal elements not only on the 
border but at numerous other locations throughout the country. Increases in smug- 
gling or narcotics and other prohibited merchandise, money laundering, and com- 
mercial fraud would be a real possibility. 

Traveling Pubiic 

TheTraveling Public would be adversely affected as advanced passenger informa- 
tion used for targeting high risk passengers may be unavailable should Customs, 
air carriers and cruise ships systems fail due to Year 2000 related problems. A re- 
sult would be that a larger number of passengers would be interviewed and luggage 
searched leading to increased passenger processing time, missed transportation con- 
nections and a possible "melt down" at international processing facilities. 

Banking Industry 

Most of the payments to and from Customs are automated. Filers transmit pay- 
ment authorization electronically. The payer's account is debited and the Customs 
account is credited with the amount due, requiring no paper payments and no cash- 
iers. Additionally, Customs clearinghouse bank automatically provides debit infor- 
mation to the payer's (trade community) bank. To revert to manual processing of 
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checks would adversely Impact not only cash flow to Customs but would result In 
an overwhelming Increase In labor costs for both Customs and the payer's banks to 
process the millions of checks generated dally. The accuracy and timeliness of pay- 
ment data would also be Impacted. 

Other Government Agencies 

Other Government Agencies Interface with Customs computer systems and would 
experience problems should Customs not be Year 2000 compliant. One Customs sys- 
tem edits broker transactions against classifications established by the Census Bu- 
reau. The classification parameters are generally measured against tariff numbers. 
The data Is gathered from the entries and Is collected to support the Census Bureau 
statistical data capture needs. 

The Fish and Wildlife Service, Food and Drug Administration and U.S. Depart- 
ment of Agriculture rely on Customs selectivity modules to support their compliance 
efforts. These agencies would have to revert to manual methods, should they no 
longer be able to rely on Customs systems. 

Antidumping and Countervailing (AD/CVD) enforcement would be Impacted by 
the loss of Customs computer systems. When a United States Industry files a claim 
that merchandise Is Illegally being sold at less than fair value, these systems are 
used to track the case as It Is Investigated. Data Is maintained by the U.S. Depart- 
ment of Commerce and Is used by Customs as part of Its Investigative function. 

Y2K Program 

To address the renovation efforts and potential problems. Customs developed a 
comprehensive Y2K Program. The Y2K Program was developed In compliance with 
General Accounting Office guidelines to address the efforts required to bring IT sys- 
tems and non-IT activities In compliance with Y2K requirements. To provide over- 
sight totheY2K Program, the Executive Council composed of senior Customs man- 
agers was formed. The Program ensured that an approach was taken to address vul- 
nerability assessments, renovation of mission critical systems, validation of efforts 
and Implementation. Also, the Program Included provisions for the completion of 
non-IT building and equipment surveys. Comprehensive strategic and operations 
plans were developed to guide the Y2K efforts through each step of the process In 
conformance with the GAO requirements and 0MB mandates. Contingency plans 
were developed to address Customs mission critical computer systems In the event 
of major systems failures. Contingency plans are also In process to address non-mls- 
slon critical computer systems, computer operating systems and telecommuni- 
cations. 

For non-IT Items, we are continuing the assessment of building systems, equip- 
ment and security systems. Most of these systems and products do not date 
functionality or are compliant. Solutions and fixes have been Identified, but must 
be validated or tested. Our biggest challenge will be ensuring that personal comput- 
ers and LANS located In over 1500 locations are compliant, either through modifica- 
tion or replacement 

Customs Is on schedule to meet target dates established by the Y2K Program 
plans. Of the 21 million lines of code associated with mission critical systems, to 
date 88 percent have been renovated, 60 percent have been tested and 37 percent 
are In production. By October 1, 1998, all mission critical and non mission critical 
systems are to be In production to allow for a full fiscal year of operation before the 
year 2000. By March 31, 1999, all non-IT systems (telecommunications, building 
equipment, etc.) are to be In production. 

Costs 

Project costs to complete the Y2K renovations are estimated at $122 million. 
These costs represent the estimated expenditures from project conception In FY 
1997 to completion In FY 2000, but do not Include $1.5 million for Independent ver- 
ification and validation. The $122 million Includes: 

—$34.1 million relates to the three mission critical systems, 

—$50.5 relates to non applications (personal computers, mainframe upgrade. In- 
frastructure, etc), 

— $10 million relates to non-IT systems, 

— $9 million totheY2K Program Office, and 

—$18.1 million for government labor. 

The Y2K Program approach has several long term benefits beyond the conversion 
to the Year 2000. This approach has allowed us to streamline application Inventory, 
create a central repository by tying applications to files, tables and Internal and ex- 
ternal users Implementing a Uniform methodology, and develop standard metrics 
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for measuring performance. We realize that there is much left to be done. We will 
continue to follow our Y2K Project approach and move toward our implementation 
goals. This concludes my statement for the record. I will be happy to answer and 
questions the Committee may have. Thank you again for this opportunity to appear 
before the Committee. 


Chairman J ohnson of Connecticut. Thank you very much. We 
have been notified of a vote so i think with five of us here we'ii 
each ask one question, so we get one brief round, and then in case 
anyone can't come back for a few minutes, they wiii have had one 
chance. 

i'ii start with Mr. Caiiahan. First of aii, thank you aii very much 
for your testimony, it's apparent that you are aii very focused on 
this project in your various agencies, it aiso is apparent that time 
is an advantage, Mr. Dyer, that Sociai Security started eariy and 
you are weii advanced, i hope that some of your testing experience 
may give guidance to others that are weii behind you, and prevent 
them from making unnecessary mistakes. 

Mr. Caiiahan, iast month you testified before the House Appro- 
priations Subcommittee on Labor, Heaith and Human Services, 
and Education, of HCFA's great concern of the siow pace the Medi- 
care contractors were making toward meeting their year 2000 
goais. What triggered your concern and how confident are you that 
the contractors are meeting this? And do you have any reason at 
aii to beiieve that you shouid have any concern about the Medicare 
Choice pians? 

Mr. Callahan, in terms of what triggers our concern. Madam 
Chairman, obviousiy, the basic concern is they have to be up and 
running the 70 systems, as you know, process aii those 900 miiiion 
fee-for-service daims. We have visited HCFA staff, as weii as some 
departmentai staff, have now visited aii the 70 contractors and i 
think there's a generai feeiing that whiie a number of the contrac- 
tors are making some significant progress, obviousiy, we wouid iike 
to be in a position to have them aii be ready to do end-to-end test- 
ing by December 31, 1998. i think that's a taii order and so that's 
the reason i indicated my concerns at the Subcommittee hearing. 
With regard to Medicare-fchoice, i think the issue is somewhat the 
same as Mr. Rossotti mentioned. A iot of the peopie we're having 
deaiing with the programming of systems have to do year 2000, 
they initiaiiy were doing transition work to singie A and singie B 
systems which we've now suspended so that they can go back to 
year 2000 work. So, i wiii give you an answer for the record about 
the impact of this on our Medicare Choice contractor systems, i 
don't have a definitive answer for you right now. 

Chairman J ohnson of Connecticut. OK, thank you very much. 

Mr. Coyne. 

Mr. Coyne. Thank you. Madam Chairman. Mr. Dyer, are there 
any particuiar concerns that you have with regard to the adminis- 
tration, Sociai Security Administration's systems interface with 
i RS, the empioyers and others that you deai with? 

Mr. Dyer. At this time, we do not have any concerns. We track 
it. i have a iist biweekiy of where we are, whom we're working 
with. As i mentioned, 65 percent of our data exchanges are year 



56 


2000 compliant and have been implemented, and we've set our pri- 
ority, obviously, on being able to assure we get our payments out, 
our checks out, direct deposits made successfully, and we're zeroed 
in on it. At this time, we're not aware of any problem. 

Mr. Coyne. And your relationships with the others doesn't 
present you a problem? 

Mr. Dyer. No, we've been working very closely with everybody 
at this table. 

Mr. Coyne. Thank you. 

Chairman] ohnson of Connecticut. Mr. Hulshof. 

Mr. Hulshof. Mr. Callahan, following up Mrs. Johnson's ques- 
tions regarding the contractor issue, seems that a lot of the claims 
processing contractors are doing a great deal of non-Medicare busi- 
ness which requires Y2K compliance systems. I n fact, some of your 
part B claims processing is done by a firm that is well known with- 
in the industry. So is there a problem with these contractors? I'd 
like you to elaborate just a little bit if you would. 

Mr. Callahan. Well, I can't give you a specific answer for every 
specific contractor. I'll give you this general answer. We do know— 
it's our understanding that on their non-Medicare side of the busi- 
ness, which is the proprietary side, they're obviously moving heav- 
en and Earth to make sure that that part of their business is Y2K 
compliant. We would hope, obviously, that the lessons they learn 
there will be reflected back over into the Medicare side. One thing 
that I would mention is that we indicated in my testimony that we 
believe there is a need for additional resources for the contractor 
effort at HCFA to make it Y2K compliant. We received another $20 
million. We're going to be transferring probably another $43 mil- 
lion as quickly as we can and another $60 million in 1999. So we 
will move the resources as best we can into this effort. 

Chairman J ohnson of Connecticut. Thank you. 

Ms. Thurman. 

Ms. Thurman. Mr. Dyer or Ms. Craig, in following up to Mr. 
Coyne's question, we talked a lot about agencies within agencies, 
what about direct deposit where we would be working with banks? 
What is happening in that area? 

Mr. Dyer. Why don't you go ahead. 

Ms. Craig. The Federal Reserve System has already announced 
that they are compliant, and for the electronic payments, we actu- 
ally transmit those payments to the Federal Reserve and then 
they're working with all the financial institutions. Most of them, 
we think, are rang OK. If it should turn out that there is a bank 
that is not ready, that payment would then come back as non- 
receipt, and we would, back through the Federal Reserve, through 
Treasury, to Social Security. So it wouldn't get lost, it's just that 
it would take extra time then to either reissue it as a check pay- 
ment or wait until that bank was ready to issue it. 

Ms. Thurman. OK, thank you. 

Chairman J ohnson of Connecticut. I think it was Mr. Callahan, 
one of you mentioned in your testimony that in the telecommuni- 
cations area, some of the companies did not have Y2K compliant 
components yet. Which one was it? 

Mr. Flyzik. Madam Chairman, yes, that was me— Treasury oper- 
ates the largest private communications network in the civilian 
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government and one of the risks I identified is the massive com- 
plexity of scheduling this. We're scheduling around the IRS tax 
season. We're scheduling around what we n^ to do to support all 
the bureaus as well as then trying to plan that as vendor compliant 
products become available, we need to factor in their schedules. 
One of the high-risk areas we have is some of those vendors sched- 
ules have continued to move and have been moving targets which 
means we are constantly adjusting our schedules to be able to do 
end-to-end testing. So even though many of our applications will be 
available, say in Washington and out in various regions, the ability 
to test them across the entire United States for all the components 
that we're relying on from the commercial services, individual prod- 
ucts, and vendor's components has been an issue we're dealing 
with. 

Chairman J ohnson of Connecticut. This is extremely concerning. 
I mean it's very clear from all of you the role the telecommuni- 
cations system plays in the government being able to serve nation- 
ally and internationally its taxpayers and customers. And if we can 
do everything we're responsible for doing but can't get the parts 
then we have the same outcome. So I would like to have you get 
back to me about how serious this is, what can be done, is there 
a way to press forward on a second set of suppliers. We have faced 
these situations sometimes in defense areas, and certainly we can- 
not allow the possibility of untimely delivery of components to pre- 
vent us from moving forward if we've met all the other manage- 
ment challenges and technical challenges associated with being 
compliant with the year 2000 demand. So if there's— I think you 
need to enlarge on that for us and I think we need to talk through 
whether there's any way that we could be a more helpful partner 
in achieving that goal. I am going to dismiss this panel. We're 
going to go vote, give you all a break. I 'm sorry that we didn't have 
a longer question period but I appreciate the quality of your testi- 
mony and also because we haven't had much time to question, we 
may follow up with written questions not raised and then, of 
course, there is some conversation to go forward on issues raised. 

We'll recess for, is it one vote or two? One vote. We'll recess until 
12. Thank you. 

[Recess.] 

Mr. PoRTMAN [presiding]. First, John Race is here, research di- 
rector of the Gartner Group, Inc., in Rosemont, Illinois. We're also 
going to hear from Harris N. Miller, president of Information Tech- 
nology Association of America; Steven McManus, who is commu- 
nications manager of the BankBoston, Boston, Massachusetts; 
Irene Dec, vice president, information systems. Prudential Insur- 
ance Co. of America; ] ennifer J ackson, general counsel of the Con- 
necticut Hospital Association, on behalf of the American Hospital 
Association; and Mary Nell Lehnhard who is senior vice president. 
Office of Policy and Representation, Blue Cross and Blue Shield. 

Mr. Bace, if you could begin the testimony. We'll just go right 
down the line. We have 5 minutes for your formal presentation, 
and any written material you have will be happily accepted into 
the record, but we want to keep it on track so we have a chance 
to ask questions. 

Mr. Bace. 
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STATEMENT OF J OHN BACE, RESEARCH DIRECTOR, GARTNER 

GROUP, INC. 

Mr. Bace. Very gcxxJ. Thank you, Mr. Chairman, and Members 
of the Subcommittee. My name is J ohn Bace and I 'm a research di- 
rector for the Gartner Group and I would like to take this oppor- 
tunity to thank you for inviting us today to share with you our 
findings on the year 2000, or Y2K as it's known, and the state of 
work underway on year 2000 projects, both here in the United 
States and around the world. 

Before I get into the details of our research, allow me to tell you 
something about the Gartner Group. Found^ in 1979, we're the 
world's largest information technology research and advisory firm, 
with more than 33,000 individual clients at more than 9,000 orga- 
nizations worldwide. We cover this very fast growing industry with 
more than 750 analysts located in 49 countries around the world. 
We published our first research about the upcoming impact on Y2K 
back in 1989 and we're sorry to say that we can only deduce that 
our warnings and suggestions have gone mostly unheeded. Our 
current research, completed in the first quarter of 1998 on the 
state of the IT infrastructure regarding year 2000 makes us very 
pessimistic. Indeed, the year 2000 problem infesting the world's 
computers and IT systems has the potential to have a negative im- 
pact on or to disrupt the normal flow of everything we do, from 
brewing our coffee in the morning and recording our favorite tele- 
vision show at night, to putting into question our financial net 
worth or keeping track of who we are and where we work. 

At the heart of this problem, as you've heard time and again, is 
the practice of using only two digits to record the year in computer 
programs, records, and database entries. Thirty-five years ago 
when hardware was expensive and storage was scarce and the in- 
dustry was evolving quickly, the use of two digits for years was 
considered a best practice. The programmers or systems analysts 
of the day never thought that the programs that they were writing 
would survive to the end of the decade, much less into the next 
century. Indeed, many companies faced many Y2K crises in 1969, 
1979, and 1989 as they wrestled with some computer programs 
that kept track of the year with only one digit. However, the way 
the industry evolved building the next generation on top of the pre- 
vious, those best practices of yesteryear became the cracks in the 
foundation that threaten the entire house today. 

As a result, we stand on the threshold of an unpredictable and 
uncertain future. No one is completely sure what impact this year 
2000 problem will have on us personally, on the economy, or the 
society in general. Some will lead you to believe that the problem 
will begin at the stroke of midnight on December 31, 1999. Indeed, 
some scenarios recall the fifties science fiction movie, 'The Day the 
Earth Stood Still," with lights going out, motors grinding to a halt, 
and airplanes falling from the sky. 

These are not the subjects of our research at the Gartner Group 
regarding the year 2000. We believe that the fundamental com- 
puter programs, those that are used to run most companies have, 
in some cases, already experienced the year 2000 anomaly. Indeed, 
some production planning systems that use a 5-year resource bal- 
ance view, hit the Y2K wall 3 years ago. I nsurance companies and 
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financial institutions that calculate interest rates have been wres- 
tling with and doing work around the 00 year for some time. In 
each case, as these companies hit their time horizon failure, or 
THF, as we call it, normal operations were interrupted and the re- 
sources of the enterprise were thrown in to fight the problem in cri- 
sis mode. 

Most have handled these year 2000 problems successfully and 
have done nothing more than create a small ripple through the eco- 
nomic structure of the company. What worries us at the Gartner 
Group is that as we approach New Year's Eve 1999, more and more 
companies will hit their time horizon failure on more and more dif- 
ferent applications. As a result, more and more business functions 
within each enterprise will be negatively impacted and need to be 
dealt with in a crisis mode. We're afraid that there just will not be 
enough talent and resources available, given the amount of time 
left, to handle all of the potential failures in a timely fashion. As 
a result, companies could lose the ability to process invoices, issue 
payroll checks, or collect taxes for an unpredictable amount of time 
as they wrestle with each system failure. Other companies who are 
dependent upon electronic commerce, EDI, or just-in-time manufac- 
turing need to be concerned about the integrity of the systems of 
their trading partners and their supply change. For example, the 
inability of a parts supplier to be able to correctly read inventory 
levels at manufacturing companies could shut down another firm's 
production line. The result is that no one single year 2000 problem 
hits a major artery that could kill a company, however, the com- 
bination of failures within the enterprise and from outside might 
have the effect of disrupting business in such a way that the com- 
pany bleeds to death instead from a series of paper cuts. 

As normal business operations are interrupted, there will be 
follow-on economic disruptions. Some say the impact will be mild, 
a two- or three-quarter dip in the gross national product that will 
feel like a speed bump on the road of the longest economic expan- 
sion in history. Others suggest that the year 2000 business disrup- 
tions will be a pothole that finally puts to an end our growing econ- 
omy. Indeed, one estimate suggests the economic impact will be 
equal to the OPEC oil embargo in 1972. 

Finally, before I get into the details of our research, allow me to 
share with you one last observation about the year 2000 market- 
place. Some estimate that Y2K has the potential to become the 
most litigious event in the history of civilization. Indeed, if the 
Internet is any indication and depending upon the type of search 
engine you use, you may find nearly one half of the results from 
a search on year 2000 and Y2K to be from law firms or class action 
groups preparing for the results of the new millennium crossover. 
Lloyds of London, at an underwriter's conference in j une 1997, es- 
timated impact of year 2000 total cost for just the United States 
at $1 trillion. The Lloyds' figure included not just the cost of hard- 
ware, software, and services for remediation, but also the cost of 
litigation, actual and punitive damages, and lost opportunity cost. 

Five years ago, the Gartner Group began work on a measure- 
ment tool called the COMPARE Scale, and COMPARE stands for 
compliance, progress and readiness. Our clients told us that they 
wanted a universally understood yardstick that could be used to 
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communicate within the enterprise, the board of directors, auditors, 
trading partners, and customers, about the status of the year 2000 
remediation efforts. 

Mr. PoRTMAN. Mr. Bace. 

Mr. Bace. Yes. 

Mr. PoRTMAN. Could I ask you to summarize the remainder of 
your oral testimony? Again, knowing that your entire written state- 
ment will be made part of the record. 

Mr. Bace. Very well, sir. In essence, what we find as of the first 
quarter of 1998, is there are only 5 percent of all companies in the 
world that are fully remediated year 2000 capable. They are at 
what we call level 4, which is all mission-critical systems fully 
operational and the enterprise is operationally sustainable, the en- 
terprises are at 10 percent. Those who have at least 20 percent of 
their systems remediated and in work is at 25 percent, and we find 
approximately 50 percent of all companies have, at this point in 
time, not touched a single line of code at work in Y2K. And if we 
project that out to the future, given the trend lines, by J anuary 1 
in the year 2000, only 50 percent of the companies of the world, 
the enterprises of the world will be at what we call level four, or 
level five which is basically operationally sustainable vis-a-vis year 
2000 . 

[The prepared statement follows:] 

statement of J ohn Bace, Research Director, Gartner Group, Inc. 

Good afternoon Madam Chairwoman and members of the committee. My name is 
J ohn Bace and I am a research director for the Gartner Group. I wouid iiketotake 
this opportunity to thank you for inviting us here today to share with you the find- 
ings of our research on theyear 2000— or Y2K as it is known— and the state of work 
underway on year 2000 projects both here in the United States and around the 
worid. 

Before I get into the detaiis of our research, aiiow me to teli you something about 
the Gartner Group. Founded in 1979, we are the worid's iargest information tech- 
noiogy (IT) research and advisory firm with more than 33,000 individuai dients at 
more than 9,000 organizations woridwide. We cover this very fast-growing industry 
with more 750 anaiysts iocated in 49 countries around the worid. 

We pubiished our first research about the upcoming impact of the Y2K probiem 
on IT organizations back in 1989. We are sorry to say that we can oniy deduce that 
our warnings and suggestions have gone mostiy unheeded. Our current research— 
compieted in the first quarter of 1998— on the state of the IT infrastructure regard- 
ing year 2000 makes us very pessimistic. 

I ndeed, the year 2000 probiem infesting the worid's computer and IT systems has 
the potential to have a negative impact on to disrupt the normal flow of everything 
we do: from brewing our coffee in the morning and recording our favorite television 
show at night to putting into question our financial net worth or keeping track of 
who we are and where we work. 

At the heart of this problem is, as you have heard time and again, the practice 
of using only two digits to record the year in computer programs, records, and data- 
base entries. Thirty-five years ago when hardware was expensive, storage was 
scarce, and the industry was evolving quickly, the use of two digits for years was 
considered a best practice. The programmers or systems analysts of the day never 
thought the programs they were writing would survive to the end of the decade, 
much less into the next century. Indeed, many companies faced mini-Y2K crisis in 
1969, 1979 and 1989 as th^ wrestled with some computer programs that kept track 
of the year with only one digit. 

Flowever, the way the industry evolved, building the next generation on top of the 
previous, those best practices of yesteryear became the cracks in the foundation that 
threaten the entire house today. As a result, we stand on the threshold of a unpre- 
dictable and uncertain future. No one is completely sure what impact this year 2000 
problem will have on us personally, on the economy, or on society in general. 

Some will lead you to believe that the problem will begin at the stroke of mid- 
night on December 31, 1999. Indeed some scenarios recall the 1950s science fiction 
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movie 'The Day the Earth Stood Still" with lights going out, motors grinding to a 
halt, and airplanes falling from the sky. These are not the subjects of our research 
at the Gartner Group regarding the year 2000. We believe that the fundamental 
computer programs, those that are used to run most companies, have in some cases 
already experienced a year 2000 anomaly. Indeed, some production planning sys- 
tems that use a five year resource balance view, hit their Y2K wall three years ago. 
Insurance companies and financial institutions that calculate interest rates have 
been wrestling with and doing work-arounds the zero-zero year for sometime. 

I n each case, as these companies hit their Time Horizon to Failure (THF), normal 
operations were interrupted and the resources of the enterprise were thrown in to 
fight the problem in a crisis mode. Most have handled these year 2000 problems 
successfully and have done nothing more than create a small ripple through the eco- 
nomic structure of the company. 

What worries us at the Gartner Group is that as we approach New Year's Eve 
1999, more and more companies will hit their Time Horizon to Failure on more and 
more different applications. As result, more and more business functions within 
each enterprise will be negatively impacted and need to be dealt with in a crisis 
mode. We are afraid that there just will not be enough talent and resources avail- 
able, given the amount of time left, to handle all of the potential failures in a timely 
fashion. As a result, companies could lose the ability to process invoices, issue pay- 
roll checks, or collect taxes for an unpredictable amount of time as they wrestle with 
each system failure. 

Other companies who are dependent upon electronic commerce, EDI, or just-in- 
time manufacturing need to be concerned about the integrity of the systems of their 
trading partners and their supply chain. For example, the inability of a parts sup- 
plier to be able to correctly read inventory levels at a manufacturing company, could 
shut down another firm's production line. 

The result is that no one single year 2000 problem hits a major artery that could 
kill a company. However the combination of failures within the enterprise and from 
the outside might have the effect of disrupting business in such a way that the com- 
pany bleeds to death instead from a series of paper cuts. 

As normal business operations are interrupted there will be follow-on economic 
disruption. Some say that the impact will be mild, a two or three quarter dip in 
the Gross National Product that will feel like a speed bump on the road of the long- 
est economic expansion in history. Others suggest that the year 2000 business dis- 
ruptions will be the pot hole that finally puts to an end our growing economy. In- 
deed one estimate suggests the economic impact will be equal to the OPEC oil em- 
bargo of 1972. 

Finally, before I get into the details of our research, allow me to share one last 
observation about the year 2000 marketplace. Some estimate that Y2K has the po- 
tential to become the most litigious event in the history of civilization. Indeed, if 
the Internet is any indication, and depending upon the type of search engine you 
use, you may find nearly one-half of the results from a search on "year 2000 or Y2K'' 
to be from law firms or class action groups preparing for the result of the new mil- 
lennium crossover. Lloyds of London, at an underwriter's conference in J une of 
1997, estimated the impact of year 2000 total cost for just the United States at one 
trillion dollars. The Lloyds figure included not just the cost of hardware, software, 
and services for remediation, but also the cost of litigation, actual and punitive dam- 
ages, and lost opportunity cost. 

Five years ago, Gartner Group begin work on a measurement tool called the 
COMPARE Scale. COMPARE stands for COM pi iance Progress And REadiness. Our 
clients told us they wanted a universally understood yardstick that could be used 
to communicate within the enterprise, the board of directors, auditors, trading part- 
ners, and customers about the status of their year 2000 remediation efforts. 

The scale, which is seen in Figure One, is graphically illustrated as a smooth set 
of equal steps. In reality, the scale is logarithmic, which means it is nearly twice 
as difficult to go from step three to step four as it was to go from step two to step 
three. 
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Figure One 



Fully Compliant 

Operational Sustainability 

Plan Complete/ 
Resources Committed 

Problem Determination 
Preliminary Activity 


The scale begins, of course, at Level Zero, which means no awareness of the year 
2000 problem. At Level One, the enterprise is in the information gathering stage, 
planning resources, and establishing vendor compliance requirements. 

At Level Two, the enterprise has a full and complete inventory of its IT portfolio, 
the core team for theY2K Project Management Office has been selected, test scripts 
are being developed, non-IT and embedded systems are being reviewed and an im- 
pact analysis is underway. 

At Level Three, the key requirements that need to be met for the enterprise are 
that the budgets are fully approved, assessment is complete as well as the impact 
analysis and the test scripts are fully developed. By this point in time, the enter- 
prise needs have completed at least 20 percent of mission critical systems remedi- 
ated, tested and reimplemented as well as 20 percent of its PC and desktop assets. 

At Level Four, the remaining 80 percent of all mission critical systems are fully 
remediated, tested, and reimplemented. Which means, the IT systems provide the 
enterprise operational sustainability to reach the millennium crossover point. 

At Level Five, the key factor for success is that all of the trading partners, elec- 
tronic commerce links, and supply chain systems for the enterprise are fully remedi- 
ated, tested, and functional. 

In the first quarter of 1998, Gartner Group undertook a survey of 6,000 compa- 
nies in 47 countries to determine the worldwide status of year 2000 projects. This 
survey sample was developed in such a way as to give us the most accurate and 
detailed status by size of enterprise, industry, and geography. FigureTwo shows the 
results of our worldwide findings. 
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Figure Two. Worldwide COMPARE Scale Results as of 1Q1998 
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The meet telling numbers here are the cumulative additions for Levels Zero, One, 
and Two. That translates into 60 percent of the world's companies which have yet 
to remediate, test, and reimplement at least 20 percent of their IT systems. Addi- 
tionally, our research shows that the five percent reporting themselves at Level Five 
are either very small companies or those with extremely limited, non-automated 
interaction with other firms. 

Flow does the United States and how do key industries show up on the COM- 
PARE Scale? I call your attention to Figure Three, which at first glance Icoks to 
be extremely complicated, but allow me to walk you through this chart. 

Figure Three 
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We can see a large oval stretching primarily from the Level One 10 percent curve 
to just beyond the 50 percent complete curve at Level Four. This represents the sta- 
tus of the United States, Australia, Canada, Israel, the United Kingdom, and Ire- 
land. Within that oval, you can see that the large investment services, large insur- 
ance companies, and large banking institutions are the furthest along on this scale, 
which translates into the lowest probability of a mission critical system failure due 
to year 2000 anomalies. 
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Figure Four 

Status by Industry — Worldwide 
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Our research indicates that governmentai agencies in the United States— state, 
iocai, and federai— are generaiiy at about 15 percent compiete in their year 2000 
projects, which wouid piace them on the threshoid of entering Levei Three on the 
COMPARE Scaie. There are, of course, some agencies further aiong than others, 
however the majority are stiii far behind in their work. 

Figures Four and Five provide an overview of the woridwide resuits by both geog- 
raphy and industry. 
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Figure Five 

Status by Geography — Worldwide 
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If these trends continue, our predictions for compietion of year 2000 projects by 
J anuary 1, 2000 are very pessimistic. Figure Six summarizes our estimates based 
on current trends. These transiate into oniy haif of woridwide enterprises reaching 
operationai sustainabiiity with 20 percent reaching Levei Five and 30 percent at 
Level Four. This does not mean we are predicting one haif of these companies wiii 
faii. What we are suggesting here is that these companies wiii experience disrup- 
tions in normai business procedures and operations due to year 2000 computer re- 
iated probiems. 


Figure Six. COMPARE Scale Predictions as of january 1, 2000 
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As a citizen of the Repubiic and an investor in the economy, I wish I couid be 
more optimistic. However, as a technologist who wrote his first computer program 
in 1968 I am painfuiiy aware of the impact even two simpie wrong digits can have 
on the operation of any IT system. As result, this is a very real problem that needs 
to be addressed quickly. 

I thank you for your time and this opportunity. 


Mr. PoRTMAN. I don't know if I should thank you for that dis- 
couraging statement, but I will thank you for your testimony, and 
I look forward to questions. [Laughter.] 
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Mr. Miller. 

STATEMENT OF HARRIS N. MILLER, PRESIDENT, INFORMA- 
TION TECHNOLOGY ASSOCIATION OF AMERICA (ITAA) 

Mr. Miller. Chairman Portman, I'm not going to be any more 
optimistic than the previous speaker, unfortunately. We, in the in- 
formation technology industry, both in the United States and glob- 
ally, are very frustrated with the lack of progress. Let me go on 
record publicly with what those in the know are thinking and say- 
ing privately. We are very, very worried. In the several years that 
ITAA has been out there speaking about this issue, I'm afraid to 
say the progress is very slow. The first panel this morning, which 
I would characterize as the Bobby McFerrin panel, "Don't worry, be 
happy," really didn't convince me very much we're making a lot of 
progress. 

I'd ask the Chair to note, that for example, they kept talking 
only about mission-critical progress. They're not even talking about 
all their systems. The jargon has changed a lot the last 3 years. 

I would also note that there was a lot of focus on contingency plan- 
ning which, again, doesn't bring a lot of optimism to one's heart. 

I'd like to talk about five areas where I think that this Congress 
can take leadership to deal with this major crisis which is not just 
a national, but international crisis. First, I believe the Congress 
needs to step up to the challenge. For example, the Senate recently 
set up a special committee which goes across jurisdictional lines, 
committee lines. I think that gives the Senate a more effective 
oversight and I would suggest the Flouse consider doing the same. 

Second, I would suggest that the U.S. Congress, because of its 
role, in essence, as the Nation's board of directors, provide a much 
more aggressive set of oversight hearings because ultimately the 
voters, the taxpayers, the citizens are going to look to you. For ex- 
ample, the Congress should call imm&iately upon the President 
and the Vice President to take a much more aggressive leadership 
role, j ohn Koskinen, the Y2K Czar, is a very outstanding public 
servant determined to do his best. But without a major commit- 
ment from the top of this country, and that means the President 
and the Vice President of the United States, we simply are not 
going to pay enough attention to this. 

Other countries have come to this realization. If you look to the 
United Kingdom where Prime Minister Tony Blair has taken lead- 
ership; If you look to Canada where the Prime Minister Jean 
Chretien has spoken; if you look to Australia where they're now 
about to embark on a national television advertising campaign, you 
see a lot more leadership from the political leaders in those coun- 
tries than you do in the United States. And that's why we believe 
the President should make a national address and Congress should 
be much more aggressive on this issue. 

Step two is it takes more money. Again, we're involved in what 
J ohn Koskinen himself has referred to as a Kabuki dance, where 
Congress doesn't appropriate more money because the agencies 
don't ask for it, and the agencies don't ask for it because they're 
trying to stay within certain predetermined budget limitations. The 
fact of the matter is if the systems go wrong, as they possibly can, 
in the Federal Government, the State governments, the private sec- 
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tor, the price to be paid down the road will be substantial. And we 
suggest very strongly that we need to get the funding available as 
soon as possible. I'm pleased to see as a citizen that we're heading 
toward a budget surplus in this country for the first time in three 
decades. But if we're not appropriating enough money to fix the 
year 2000 problem, the surplus could quickly turn into a deficit be- 
cause of the negative impact on the economy. 

We have already found in a survey that we did that 44 percent 
of organizations have already experienced a system failure. You 
will hear similar reports from other speakers later. We're rec- 
ommending, specifically, Mr. Portman, that the Congress establish 
a $500 million contingency fund immediately that would be avail- 
able, particularly during the period when Congress will be in re- 
cess— you'll be going into recess in early October and not back until 
February— that may be a critical time for the Federal agencies that 
need access to money. I think this Subcommittee could play a lead- 
ership role in that. 

Third, public education is absolutely critical. I mentioned the 
public advertising campaign in Australia. I think the government 
needs to take a much more aggressive public education role in this 
country. You need to be much more aggressive in terms of bringing 
the message back to your constituents. Every Congressperson, 
every Senator has townhall meetings. You all have newsletters. 
You need to communicate much more aggressively with your con- 
stituents. That will help get the message out there. It's not a good 
message to deliver. I know elected officials don't always like to de- 
liver messages that aren't very positive, but I know you've been 
very candid as a Congressperson in your leadership of this country, 
and I know your colleagues want to do the same. This is a time 
for real leadership. 

Fourth, when there is more public education, there's going to be 
more public demand for rational solutions. And there are some cre- 
ative public policy responses that this country has not yet looked 
at that are being looked at in other countries. For example, emer- 
gency tax incentives to help the most at-risk populations, particu- 
larly small- and medium-size enterprises, because they are the 
ones that have the most at risk. Also, research and development, 
R and D, tax credits, and credit guarantees, expedited procurement 
process, enhanced training opportunities and associated tax credits 
to deal with the work force shortage. All of this needs to be focused 
on. 

My final suggestion is discipline. We have to focus on the year 
2000 problem and to solve it. Within the Federal Government, 
State governments, local governments, and in the private sector. 
BasicaPy, what we see is what we call the big disconnect, a lot of 
talk about the crisis but not much action in terms of solution. This 
Congress could lead on discipline. You've already heard from Mr. 
Rossotti this morning, and we endorse his request that there be 
some deferral of some important tax law changes. Not elimination 
but deferral, so that there can be a focus. 

Europe, for example, has dug itself a tremendous hole by trying 
to move ahead with the year 2000 challenge at the same time as 
trying to do their Euro conversion creating, in a sense, an impos- 
sible task. Please don't do the same thing to our government, to 
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Mr. Rossotti, to any Federal agencies, by adding new IT demands 
on top of the year 2000. I n fact, Canada is implementing what they 
call oasically a change freeze, no more laws that will change IT if 
it would in any way get in the way of the year 2000. 

In summary, I would urge Congress to not perpetuate the big 
disconnect, to put the pieces together of the difficulties that are 
faced and the challenge that must be addressed. Congress has a 
critical role of planning this challenge. And I tell you that the in- 
dustry is prepared to work with you to help solve the challenge. 
Thank you very much, Mr. Portman. 

[The prepared statement follows:] 

statement of Harris N. Miller, President, Information Technology 
Association of America (ITAA) 

Madame Chairwoman and distinguished members of the Subcommittee, on behaif 
of the 11,000 direct and affiiiate members of the Information Technology Association 
of America (ITAA), I am pleased to appear before you and offer insights into the 
single most important information technology challenge facing government and in- 
dustry today— the worldwide Year 2000 software conversion. 

This is not just an information technology challenge. This is a fundamental chal- 
lenge to the ability of organizations throughout the world to continue to function. 
And it is a challenge which could have tremendous negative consequences for econo- 
mies and governments throughout the world if it is not met. 

ITAA represents information technology companies working at the forefront of 
computer software, Internet and electronic commerce, telecommunications, systems 
integration, outsourcing, consulting and more. Our members have been on the front 
lines of the struggle with the Year 2000 software challenge, helping their customers 
leap this hurdle with new products and services or Y2K specific fixes to existing sys- 
tems. As an Association, ITAA has led industry's efforts in dealing with this difficult 
issue. Because I also serve as President of the World Information Technology and 
Services Alliance (WITSA), ITAA has reached out to many international organiza- 
tions such as the Organization for Economic Cooperation and Development (OECD), 
the United Nations, the World Bank, the Bank for International Settlements and 
the G-8 to urge them to take Y2K seriously. The WITSA White Paper was the first 
international paper on the importance of Year 2000. ITAA is proud to be the organi- 
zation that the world looks to for Y2K information, news, insight and public policy 
leadership. 

You have asked ITAA to provide an assessment of the nation's Year 2000 pre- 
paredness. Let me go on record publicly with what those in the know are thinking 
and saying privately. We are very worried. When ITAA first got involved with the 
Year 2000 issue back in 1995, we talked in terms of the marketplace as a "deer in 
the headlights." In those halcyon days, we sought a balanced approach to this situa- 
tion which would educate organizations to the urgency for fast movement while not 
allowing the magnitude of the problem to cause sensory shutdown. 

How far have we come in the last three years? I must say, not very. On the first 
part of the challenge— awareness— we have done reasonably well. Virtually no one 
can say that he or she is not aware of the Y2K issue. But on the next stages— com- 
mitment to and actually solving the problem— we are very frustrated. The focus of 
conversation among those best versed in this issue is about how we are going to 
clean up after what appears now to be an inevitable train wreck. As a society, we 
are on the point of conceding failure. Those unwilling or unable to move off the 
track are numerous. Federal agencies. State governments. Local and municipal gov- 
ernments. School districts. Private sector industries. Small and mid-sized compa- 
nies. Critical infrastructure players. And most foreign nations. It's crazy. It's frus- 
trating. It cannot be happening. But it is. Now the "smart" questions have shifted 
to concentrate on contingency planning, crisis management, and liability. Lawyers 
are circling, and that is not a good sign. 

Failure is not part of the American fiber. Yet after this transition to the new cen- 
tury, society may have to admit that here was a situation it saw coming. Everyone 
understood its hard deadline. Everyone appreciated its worldwide scope. Everyone 
realized its massive potential to cause harm. And everyone let it happen. 

This morning I would like to talk what Congress can do help the country and the 
world off the path of fast approaching disaster. 

My five step program to Y2K wellness includes: 

1. Step up to the challenge 
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2. Spend the money required 

3. Educate the public to the problem 

4. Provide incentives to a solution, while highlighting contingency planning 

5. Exercise discipline in setting competing priorities 

Stepping up to the challenge means accepting the mantle of leadership on this 
issue. The Senate recently established a special Committee to deal with the Year 
2000 situation, and I encourage the House to do the same. The Senate Committee 
will provide oversight and legislative recommendations to help the government and 
private sector react quicker and more effectively to the economic difficulties arising 
from the Year 2000 system failures. The Committee will focus special emphasis on 
such areas as utilities, telecommunications, transportation, financial services, gen- 
eral government services, general business services and litigation, cutting across 
traditional jurisdictional lines. Under the leadership of Senator Robert Bennett, the 
Senate has begun to take a big step in the right direction. 

The government Y2K report cards issued by Congressman Stephen Horn and the 
hearings held on this issue by the House Subcommittee on Government Manage- 
ment, Information and Technology: the House Subcommittee on Technology: and 
other Subcommittees have also helped bring important scrutiny to bear on the per- 
formance of government agencies and, to a lesser extent, regulated industry. The 
House is to be commended for its leadership in this area. 

What has been missing throughout this process, stretching back to the first House 
hearing in 1996, is a sense of real ownership. The U.S. Congress is the nation's 
board of directors. You provide the highest level oversight of federal agencies, criti- 
cal infrastructure industries and international relations. You are ultimately respon- 
sibletoyour shareholders— the American voter. 

Year 2000 is an issue which will affect shareholder values. Those values are 
measured in the health of the national economy, consumer confidence, global trade, 
political stability and similar constructs. The proliferation of information systems 
into virtually every facet of modern life, from the embedded chips in complicated 
weapons systems to the wafer thin chip on a smart card, puts Y2K on a collide path 
with business as usual. 

With the notable exceptions that I mentioned just now. Congress has been slow 
to grapple with this issue of the century date change. The Year 2000 is a potentially 
devastating issue with breathtaking scope and an immovable deadline. The Year 
2000 challenge is a call to think beyond the routine in response to an unprecedented 
situation. Today, leadership demands that Congress move past exploratory hearings 
to concrete actions: tomorrow, your accountability will be to the American people. 

How do you exercise this leadership? First, use the power of the Legislative 
Branch to get the President Clinton and Vice President Gore. J ohn Koskinen, the 
recently appointed Y2K czar, is an outstanding public servant doing exceptional 
work in attempting to marshal a cohesive federal response. But his appointment 
came very late. We have drifted well beyond the point where anyone but the Presi- 
dent and Vice President of the United States can put the country on the necessary 
emergency response footing. The office of the Y2K Czar is staffed by four people and 
does not have the needed resources that a problem of this magnitude requires. 

Other nations have come to this realization. I n the United Kingdom, despite some 
stumbles along the way. Prime Minister Tony Blair has put the force of his govern- 
ment behind the Y2K issue, placing a Cabinet Minister in charge of a ministerial- 
level Y2K oversight group and forming a government program. Action 2000, to co- 
ordinate a government/industry response. Prime Minister Blair has proposed a set 
of initiatives valued at almost 100 million pounds, with 30 million pounds slated 
for "bug busting" training courses and 17 million pounds for programs affecting 
small and mid-sized businesses and related work. 

In Canada, Task Force Year 2000, a blue ribbon commission of key industry 
CEOs, is working with the government to make recommendations as an impetus to 
action. We would do well as a nation to use the commission's series of 18 rec- 
ommendations to bootstrap a national action agenda for the United States. 

In Australia, a national television advertising campaign is about to bring a Year 
2000 focus into the homes of average citizens and on to the radar screens of thou- 
sands of small and mid-sized businesses. 

By any measure, the U.S. is the world leader in information technology. J ust last 
month, the U.S. Department of Commerce released a report showing that informa- 
tion technology accounts for 8.2 percent of GDP, up from 6 percent just a few years 
ago, and contributes more than twenty five percent of GDP growth. With so much 
at stake, should we really be doing less than the U.K., Canada or Australia? Of 
course not. That is why we believe President Clinton should make a major national 
address on the issue immediately. That is why we believe Vice President Gore 
should be using his status as the "high tech" Vice President to press the urgency 
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of the Year 2000 message to industry groups and his standing as the "reinventing 
government" Vice President to ramp up the response within federai agencies. 

Step two. Congressionai ieadership on this issue wiii require spending the money 
required to make the necessary repairs inside government and to understand the 
status of externai trading parties. J ohn Koskinen referred to the current Y2K fund- 
ing situation in Washington as "a grand kabuki" dance, with federai agencies refus- 
ing to step forward with requests for additionai funding and Congress unwiiiing to 
suppiy the funds untii such requests are made. President Ciinton, speaking through 
the Office of Management and Budget, has toid his agency heads to reprogram the 
necessary doliars. 

This dance has been going on for at ieast two years now. Unfortunateiy, federai 
agencies have too often piaced the need to protect programs and jobs in front of the 
more urgent requirement to soive their Year 2000 probiems. Nothing wiii 
changeunless you change it. I urge you to stop the kabuki dance by forcing agencies 
to disciose the ievei of reprogramming now underway. I respectfuiiy suggest that if 
an agency is not appropriated new Y2K funds and is not reprogramming existing 
funds, insufficient date repair work of consequence is being performed. I am pieased 
that the U.S. government wiii run a budget surpius this year for the first time in 
decades, but if one of the prices for doing so is not fixing the Y2K probiem, that 
is a very bad trade-off. The negative economic consequences of not fixing Y2K couid, 
some economists are predicting, iead to a substantiai siowdown in our country's eco- 
nomic growth. This, in turn, wouid iead to reduced tax revenues and head our fed- 
erai budget back towards deficits. 

Congress can be part of the solution by demonstrating the risk management strat- 
egies now urged for the marketplace as a whole. Part of risk management involves 
having the vision to plan for contingencies. Given where the federal government 
stands today, I feel very confident in predicting that some mission critical govern- 
ment systems will fail— perhaps as early as J anuary 1, 1999. A recent ITAA survey 
showed that 44% of organizations have already experience a Y2K failure. 

ITAA is not alone in stating this likelihood of failure: the General Accounting Of- 
fice (GAO) also shares this assessment If and when these failures happen, re- 
programming dollars or protecting federal workers— the federal kabuki dance— may 
at last be considered beside the point. I assume that at that unhappy point in time, 
government agency heads will be ready to contract with private sector firms special- 
izing in Y2K remediation and testing to expedite the necessary repairs. We suggest 
that a special $500 million contingency fund be established to cover the period of 
October 1998 through February 1999. Congress will be adjourned during most of 
this period— a period during which emergency access to additional funds may prove 
critical. 

I also urge this Subcommittee— and every other Subcommittee with oversight au- 
thority— to require agencies to identify and respond to their inter-government and 
extra-government interfaces. Such electronic handshakes must be made with state 
governments, municipalities, foreign nations, and private sector firms. The smooth 
functioning of government depends on the ability of these highly integrated systems 
to operate without date errors. While Mr. Koskinen and the Federal CIO Council 
are making attempts to build the list of external interfaces with state governments, 

I suggest that Congress make this cross-cutting project its own, spending whatever 
funds are necessary to acquire the private sector expertise necessary to perform 
quickly and effectively the work. 

Step three. Public education is critical. I mentioned the public service advertising 
campaign launched in Australia. I urge Congress to make Year 2000 a the top prior- 
ity issue of the U.S. government for at least the next two years. No services are 
more important to Americans than Social Security and Medicare: no system may be 
more important to the efficient operation of government than tax collection. Your 
conviction to hold this hearing today is a stake in the ground. Now build on this 
good start by continuing to hold Y2K hearings. Also, as you get public and private 
sector CEOs, CFOs, and CIOs in these witness seats, whether or not the hearing 
is specifically related to Year 2000, ask about Y2K status. The answers you receive 
may be very revealing. And do not accept pat responses or easy assurances. Con- 
gress is the steward of the public trust. I urge Congress to keep asking questions 
and to drill down for substantive answers. Doing so will help the public understand 
this issue, and where they should concentrate their concerns moving forward. 

Individual Congressmen and Senators can also use other tools as their disposal 
such as newsletters and town meetings to increase the awareness among the gen- 
eral public. 

Step four. Public education will inevitably lead to public demand for rational solu- 
tions. We have not begun to scratch the surface on creative public policy responses 
to this issue. Countries around the globe are considering emergency tax incentives 
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to help the most-at-risk populations— small and mid-sized enterprises— deal with 
this issue. We have begun to hear about low interest government loans to stave off 
bankruptcies. R&D tax credits and credit guarantees. Expedited procurement proc- 
esses. Productivity corps to assist small firms and proliferate best practices. En- 
hanced training opportunities and associated tax credits. And much more. We are 
limited in creativity only by our willingness to engage this issue directly. 

And that brings me to my final point this morning. Step five. Discipline. Having 
the will to attend totheYear 2000 problem and to solve it. Within our local commu- 
nities. Across states. Around the nation and throughout the world. During World 
War II, we did not become distracted by other concerns and divert precious re- 
sources to other efforts. As a country, we found the collective will to win. We discov- 
ered the discipline. Today, America's efforts to cope with the Year 2000 are diluted 
and disconnected. Indeed, we often talk about the tepid response to the Y2K tidal 
wave in terms of "the Big Disconnect." 

This Congress can help the country find its will to win by exercising discipline. 
As Congress goes to pass new laws that will require computer system changes, ask 
yourselves whether the risk is worth the reward. In Europe, we have the example 
of a rush to judgment on the Euro implementation— a competition which at best 
dramatically decreases the odds for successful Year 2000 conversion in some of the 
world’s largest economies. Here, we have a similar concern with the Internal Reve- 
nue Service (IRS). With systems already committed to the limit. Congress must 
show flexibility in asking the IRS to maintain existing systems, introduce changes 
to the tax laws, modernize and conduct the Year 2000 conversion. ITAA urges Con- 
gress to follow Commissioner Charles Rossetti's request to soften some of its 
timelines in the current legislation in order to ensure that our tax collection system 
is able to operate effectively in the Year 2000. 

Congress must reconsider any legislation that requires major changes in the fed- 
eral IT systems. Canada is attempting to implement a "change freeze" in its govern- 
ment IT systems so all energy can be focused on Y2K. It is too late to expect govern- 
ment agencies to fix their systems while also adapting them for new programs. 
Today, by ignoring this simple reality. Congress is perpetuating "the Big Dis- 
connect." The pervasive apathy. The business as usual mentality. Today, you can 
help end it. With discipline. 

In conclusion, I urge this Subcommittee to do everything in its power to make 
Y2K preparedness a national concern. There are 602 days left. Although the train 
is barreling down the track, it is still not too late. Congress has a critical role to 
play in meeting the challenge, and the five step program I have outlined here today 
can help. Congress does not want to be placed in the position of wishing it had 
taken this issue more seriously while there was time left to address the challenges. 
The American public— and the world at large— are counting on you. ITAA is ready 
to assist you in every way possible. 

Thank you very much. 


Mr. PoRTMAN. Thank you very much, Mr. Miller. 

Mr. McManus. 

STATEMENT OF STEVEN P. MCMANUS, COMMUNICATIONS 
MANAGER, MILLENNIUM PROJ ECT, BANKBOSTON, N.A. 

Mr. McManus. Mr. Portman, I'm Steven McManus, communica- 
tions manager for BankBoston's millennium project, and I'm 
pleased to have this opportunity to present my views on the mag- 
nitude of the year 2000 problem, the associated business risks, and 
the adequacy of remediation and risk management efforts being 
undertaken by the financial services industry. 

With $71 billion in assets, BankBoston is ranked number 15 in 
the country, with over 700 offices in 24 different countries. We 
were also the first bank in the United States to receive ITAA 2000 
certification which speaks to our methods and processes in place, 
essentially, that we're on the right path. 

The year 2000 computer problem is pervasive and is global in 
scope. It affects not only the financial services industry but all in- 
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dustries. Each business is itself both a customer and a supplier in 
the food chain of international commerce. Each industry is simulta- 
neously competing for available human resources to complete its 
remediation processes against this fixed deadline in order to miti- 
gate its year 2000 risks. The millennium challenge is a significant 
project management challenge that requires institutionally focused 
attention as well addressing dependencies on its suppliers that are 
facing the very same challenge. These are the parameters that 
make the year 2000 challenge unique. 

Financial institutions are also extremely dependent on one an- 
other as well as common service providers for the interchange of 
electronic commerce. The national payment system is dependent 
upon automation to clear checks principally through the Federal 
Reserve System. The automated clearinghouses present the pri- 
mary means of processing preauthorized payments enabling auto- 
matic direct deposits of Social Security checks to the consumer's 
bank of choice, in addition to processing standing orders for repet- 
itive payments such as insurance premiums, automobile payments, 
and investments. The retail consumer is dependent on the use of 
credit and debit card conveniences offered internationally through 
suppliers such as Visa, MasterCard, and American Express, which 
have extensive electronic networks linking a transaction from its 
point of sale to the consumer's financial institution. Corporate cus- 
tomers are heavily dependent on electronic data interchange, EDI, 
wire transfers, letters of credit. The increasing globalization of the 
business enterprise radiates these dependencies beyond our borders 
to include financial institutions worldwide. It should be clear from 
these examples that there are significant risks associated with such 
tightly woven interdependencies. 

Like all financial institutions, BankBoston is heavily dependent 
on computer technology in the conduct of our business. We have 
major data centers in New England, London, Brazil, Argentina, 
and Singapore with large scale data communications networks 
linking these centers to our branches, remote offices, customers, 
and service providers like the Federal Reserve. Additionally, we 
participate in multiple delivery networks for ATM processing, point 
of sale services, information exchanges, and other forms of elec- 
tronic commerce. 

This dependence on technology was the prime motivation for 
BankBoston to begin its millennium project in the spring of 1995. 
The initial assessment of our systems inventory revealed that 
roughly 50 percent of our software is supplied to us by external 
vendors and that this vendor supplied software is usually cus- 
tomized to meet the unique needs of our institution. This heavy re- 
liance on external vendor software, which is common within finan- 
cial services, represents the single biggest risk in being able to 
meet the millennium challenge since the timely deliver of this mil- 
lennium compliant software is outside of each bank's control. Flow- 
ever, even managing these types of software risks that are germane 
to individual institutions will only help ensure millennium compli- 
ance within their own spheres of influence. 

I'd also tell you that the year 2000 problem is very real at 
BankBoston which identified and corrected millennium related 
logic errors within systems that have already been through our re- 
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mediation process. I have four examples in my written testimony 
that include our certificates of deposit system, negotiable collateral 
system, and our controlled disbursement system, as well as pre- 
cious metals. 

So keep in mind that these situations, had they not been identi- 
fied in advance, our ability to respond to all of them simultaneously 
in the year 2000 may have been hampered by the availability of 
computer resources and the pressures brought on by the demands 
of our customer base. As I mentioned earlier, BankBoston had 
begun its millennium preparedness in early 1995. As such, I feel 
comfortable that we will be able to complete our internal prepared- 
ness, given the project organization processes that we currently 
have in place. 

But it has taken us 3 years to structure this very rigorous pro- 
gram that we have in place today. Our project also includes not 
only information technology by the non-IT issues, the business' risk 
issues which I've listed in my written testimony. This side of our 
project is headed by our executive vice president of risk manage- 
ment, and this program is reviewing the potential risks associated 
with each major line of business, and they're outlinad in my writ- 
ten testimony. 

And I bring our model to your attention, not only because we're 
proud of what was accomplished, but to underscore the fact to you 
that it has taken us 3 years to get where we are today. Knowing 
that all financial institutions must address the very same issues 
that we have faced with much less time remaining. I'm concerned 
with the general preparedness of the rest of the financial services 
industry. In my discussions with other banks, customers, and serv- 
ice providers, I feel that unless comparable programs to 
BankBoston's are put in place within the next few months, the ef- 
fect will adversely impact even those that are adequately prepared. 

And this concludes my testimony. 

[The prepared statement follows:] 

statement of Steven P. McManus, Communications Manager, Millennium 
Project, BankBoston, N.A. 

Mrs. J ohnson and distinguished members of the Subcommittee, my name is Ste- 
ven McManus and I am the Communications Manager for the Miiiennium Project 
at BankBoston. I am pieased to have this opportunity to present my views on the 
magnitude of the Year 2000 probiem, the associated business risks, and the ade- 
quacy of remediation and risk management efforts being undertaken by the finan- 
dai services industry. 

Let me first teii you a iittie about who we are. We are a iarge New Engiand based 
Superregionai Bank hoiding company with $71 biiiion in assets, ranked number 15 
in the United States with 475 branches and 275 offices iocated in 24 countries. We 
offer a compiete range of finandai products and services both domesticaiiy and 
internationaiiy. 

The Year 2000 computer probiem is pervasive and is giobai in scope. It affects 
not oniy the finandai services industry, but aii industries. Each business is itseif 
both a customer and a suppiier in the food chain of internationai commerce. Each 
industry is simuitaneousiy competing for avaiiabie human resources to compiete its 
remediation processes against a fixed deadiine in order to mitigate its Year 2000 
risks. The miiiennium chaiienge is a significant project management chaiienge that 
requires institutionaiiy focused attention as weli as addressing dependencies on its 
suppiiers that are facing the very same chaiienge. These are the parameters that 
make the miiiennium chaiienge unique. 

Finandai institutions are extremeiy dependent on one another as weii as common 
service providers for the interchange of electronic commerce. The nationai payment 
system is dependent upon automation to dear checks principaiiy through the Fed- 
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eral Reserve System. The Automated Clearing Houses represent the primary means 
of processing pre-authorized payments enabling automated direct deposits of social 
security checks to the consumer’s Bank of choice in addition to processing standing 
orders for repetitive payments such as insurance premiums, automobile payments, 
and investments. The retail consumer is dependent on the use of credit and debit 
card conveniences offered internationally through suppliers such as VISA, 
MASTERCARD, and AMERICAN EXPRESS which have extensive electronic net- 
works linking a transaction from its point of sale to the consumer's financial institu- 
tion. The Corporate customer, heavily dependent on Electronic Data Interchange 
(EDI), Wire Transfers, and Letters of Credit, uses the nation's financial institutions 
as their financial intermediaries. The increasing globalization of the business enter- 
prise radiates these dependencies beyond our borders to include financial institu- 
tions worldwide. It should be clear from these examples that there are significant 
risks associated with such tightly woven interdependencies. 

Like all financial institutions, BankBoston is heavily dependent on computer tech- 
nology in the conduct of our business. We have major Data Centers in New Eng- 
land, London, Brazil, Argentina, and Singapore with large scale data communica- 
tions networks linking these Centers to our branches, remote offices, customers, and 
service providers like the Federal Reserve. Additionally, we participate in multiple 
delivery networks for ATM processing, point of sale services, information exchange, 
and other forms of electronic commerce. This dependence on technology was the 
prime motivation for BankBoston to begin its Millennium Project in the Spring of 
1995. The initial assessment of our systems inventory revealed that roughly fifty 
percent of our software is supplied to us by external Vendors, and that this Vendor 
supplied software is usually customized to meet the unique needs of our institution. 
This heavy reliance on external Vendor software, which is common within the finan- 
cial services industry, represents the single biggest risk in being able to meet the 
millennium challenge since the timely delivery of this millennium compliant soft- 
ware is outside of each bank's control. However, even managing these types of soft- 
ware risks that are germane to individual institutions will help ensure millennium 
compliance only within their own spheres of influence. 

The Year 2000 problem is also very real. At BankBoston, we have identified and 
corrected millennium related logic errors within our systems that have already been 
through the remediation process. For example, we found that: 

• we would not have been able to mature our customers' Certificates of Deposits 
in the year 2000 and beyond; 

• our Negotiable Collateral system would have lost expiration dates and review 
dates on colTateral used to secure loans in the event of loan default; 

• the system processing a daily volume of $800 million of Controlled Disburse- 
ments for our corporate customers would have been inoperable for ten days while 
the problem was corrected in J anuary, 2000 resulting in massive overdrafts to the 
Bank., and; 

• our Precious Metals business would have been inoperable for up to two weeks 
while systems changes were being made to correct erroneous date processing. 

And keep in mind that had these situations not been identified in advance, our 
ability to respond to all of them simultaneously in the Year 2000 may have been 
hampered by the availability of computer resources and the pressures brought on 
by the demands of our customer base. 

As I mentioned earlier, BankBoston had begun its millennium preparedness in 
early 1995. As such, I feel comfortable that we will be able to complete our internal 
preparedness given the project organization and processes that we currently have 
in place. It has taken us two years to structure the very rigorous program that we 
have in place today. Our inventory of technology applications is under constant re- 
view and newly acquired or developed applications are being scrutinized for their 
millennium compliance, both contractually and in their acceptance testing, in order 
not to propagate the millennium problem. 

We have developed an extensive Communications and Awareness program within 
the Bank to sensitize every facet of the business to review the risks of the millen- 
nium challenge to their business. This is a mandatory program for every financial 
institution. We have also instituted a very rigorous Vendor and Contracts Manage- 
ment program to track the millennium readiness and delivery of the vendor sup- 
plied applications which account for more than half of our application inventory. We 
have developed comprehensive remediation and certification processes to carefully 
examine and test all of our systems to assure accurate operability in the year 2000 
and beyond. We have developed sound Project Administration practices to track 
costs, maintain accurate inventory, and manage issues. We have put in place and 
continually monitor the Technical Support infrastructure required to conduct reme- 
diation and certification concurrently with the day to day systems demands of our 
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business. And we have developed an elaborate Planning and Scheduling program 
that integrates our resource requirements planning, Vendor software availability, 
and triage program founded on an already existing Disaster Recovery Plan that or- 
ders our most critical applications for renovation before those of lesser importance. 

Complementing the systemic preparations being undertaken within BankBoston, 
we have a corporate-wide millennium risk management program underway where 
the potential impacts of the Year 2000 challenge are being addressed as risk related 
business issues and opportunities to gain competitive advantage. Headed by our Di- 
rector of Risk Management Assessment, this program is reviewing the potential 
risks associated with each major line of business: 

Credit. Credit policy is being reviewed to account for the potential risk that the 
borrower's ability to repay outstanding debt may be affected by the impact of the 
year 2000 on the borrower. Increased allowances for potential loan losses are accord- 
ingly being evaluated. Existing loans requiring customer unqualified financial state- 
ments are being watched in the event that the customer's own millennium prepara- 
tion expense may erode comfortable profit margins. Loan participations and syndica- 
tions require the cooperation of all participants in the evaluation of millennium re- 
lated risk. 

Finance Regulatory requirements concerning SEC lOK and lOQ millennium dis- 
closures are being reviewed as are FASB's treatment of accounting and tax implica- 
tions of millennium related expenses. 

Third Party Suppliers. Critical outsourcing arrangements such as loan portfolio 
servicing are being reviewed to ensure uninterrupted revenue streams. The risks as- 
sociated with potential disruption of critical point solutions that augment the bank's 
business functions (such as news services, stock quotations, et al) are also under re- 
view. 

Joint Ventures. The millennium preparedness of all joint ventures in which 
BankBoston is a participant is being investigated to protect the value of our invest- 
ment. 

Legai Issues. BankBoston is taking aggressive steps to conduct the appropriate 
due diligence associated with its preparedness for the millennium. These include 
supplier contract review of indemnification and warrantee provisions, board level 
project review, and escalation of critical business related issues. 

Mergers and Acquisitions. BankBoston completed a merger with BayBanks in 
1997. This merger involved extensive best of breed product integration into the sur- 
viving systems that serve the combined entity. This fifteen month effort required 
extensive systems renovation which consumed the attention of systems personnel in- 
volved with the merger. In future M&A activities, the valuation of any acquired 
software will have to be significantly discounted unless it is already millennium 
compliant. There simply isn't enough time remaining to affect product integration 
concurrent with providing for millennium readiness. 

Insurance It is imperative for all businesses to review Director and Officer liabil- 
ity insurance in addition to business interruption insurance policies currently in 
place or under renewal. Given the estimated certainty of forthcoming lawsuits sur- 
rounding predicted business failures, BankBoston has begun such reviews. 

Markeiing. The millennium prepared financial institution will enjoy a competitive 
advantage over other Banks' inaction. Cross selling of additional products and serv- 
ices to a nervous customer base will provide an opportunity for additional fee in- 
come to the millennium compliant bank. Communicating millennium strategy to the 
retail and corporate customer is becoming more of a sensitive issue as our cus- 
tomers' awareness of the millennium issue increases. 

I bring the BankBoston model to your attention, not only because I am proud of 
what we have accomplished, but to underscore to you the fact that it has taken us 
three years to experience and overcome some of the project management complex- 
ities associated with the Year 2000 challenge. Knowing that all financial institutions 
must address the very same issues that we have faced with much less time remain- 
ing, I am concerned with the general preparedness of the rest of the financial serv- 
ices industry. In my discussions with other banks, customers, and service suppliers, 

I feel that unless comparable programs to BankBoston's are put in place within the 
next few months, the effect will adversely impact even those that are adequately 
prepared. 

On a positive note, a cohesiveness is developing in the Banking industry to ad- 
dress the millennium challenge. The Bank Administration Institute (BAI), a US 
banking industry association r^resenting about 80% of the nation's banking assets, 
has been quite proactive in bringing together its membership and service providers 
to address common issues. In fact, BankBoston will be hosting a BAI Rountable on 
Read! ness Test! ng on J une 2 and 3. 
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The majority of the critical work, however, lies ahead. As I mentioned earlier, 
there is an enormous interdependency among all financial institutions on the viabil- 
ity of the payments system. All must be prepared for the millennium. All common 
financial services providers must be prepared. All systems and application vendors 
must be prepared. All suppliers and customers must be prepared. And then we must 
all test the interdependencies we share well before the year 2000 to ensure stability 
of the system not only domestically, but also globally. 

The Federal Financial Institutions Examination Council (FFIEC), has been 
proactive in delivering the urgency of the millennium challenge to the industry and 
has stepped up its examinations. In many cases, especially to smaller institutions 
that do not have the resources to manage such large scale projects against an immu- 
table deadline, the Regulatory bodies r^resented by the FFIEC will be required to 
offer assistance. As each financial institution must mitigate risk through rigorous 
contingency planning, our Regulators must develop contingency plans to assure sta- 
bility of the Banking system. We have a collective fiduciary responsibility to our cus- 
tomers and must continue to relax the roles of the Regulator and the Regulated by 
working together to ensure the safety and soundness of this nation’s banking sys- 
tem. 

This concludes my testimony. Thank you. 


Mr. PoRTMAN. Thank you, Mr. McManus. 

Ms. Dec. 

STATEMENT OF IRENE DEC, VICE PRESIDENT, INFORMATION 

SYSTEMS, CORPORATE INFORMATION TECHNOLOGY; AND 

MANAGER, YEAR 2000 PROGRAM, PRUDENTIAL INSURANCE 

COMPANY OF AMERICA 

Ms. Dec. Mr. Portman and Members of the Subcommittee, my 
name is Irene Dec and I'm vice president of corporate information 
technology for the Prudential Insurance Co. of America which is 
headquartered in New J ersey. I am Prudential's year 2000 program 
manager and lead the companywide project. I'm pleased to have 
this opportunity to present Prudential's strategies for solving the 
year 2000 problem. They are strategies that can be applied to any 
large organizations, including the government. 

Because of Prudential's size and scope, our year 2000 problem 
was monumental. Fortunately, our chief executive officer. Art 
Ryan, and our CIO, Bill Friel, recognized the seriousness of the 
problem and identified it as an enterprise priority. Prudential's en- 
tire senior management team sees year 2000 as a critical business 
issue, not a technology nuisance. 

It is too late to start early. As of today, there are 603 days left 
and 86 weekends. At this point, it's late. We began to address year 
2K in the fall of 1995 and we have moved aggressively since then. 
For those organizations that have not mov^ aggressively on the 
year 2K, I will be focusing on 10 risk management actions that 
should take place. 

First, secure executive commitment. Identify the year 2000 
project as the most critical project in your organization, and secure 
unwavering executive commitment. 

Second, establish a program office immediately, assign your best 
people, and it must be full time. 

Third, identify your critical applications, those that have the 
greatest impact on people and on business. Focus on those first. 

Fourth, stop all other projects. There is no time for applications 
or systems that are not year 2K related. Year 2000 must take com- 
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plete and total priority. When we hear year 2K is a high priority 
we must measure that priority. Simply saying, It's a high priority, 
will not get you there. 

Fifth, devote time to testing. It takes three times the normal ap- 
plication testing time. It takes over 50 percent. When you hear that 
renovation is complete, that is only 50 percent of the project done. 
Be ready. When you're testing, you will find problems, which 
means did you allow in your schedule the fact that you have to go 
back and fix again. 

Sixth, develop contingency plans. Organizations must think 
about building manual processes to do work around. You know you 
will not meet all of your objectives. Start working on those plans 
and communicating how the processes will be different. 

Seventh, review and assess business partners, including software 
vendors and other suppliers. You must also identify vendors that 
put your organization at risk and if you need to, you need to go 
out and find alternative software and business partner replace- 
ments. 

Eighth, validate desktops. In this case, I'm referring to desktops 
that are not IT controlled. In many businesses today, decisions are 
based on calculations performed on spreadsheets and databases 
that are hidden in the corners of our offices. 

Ninth, determine your computer capacity. Do not wait. In most 
cases, you need twice the capacity you have today to do the test. 

Tenth, develop and control your risk validation process. Your 
audit and management integrated control department must assist 
in validating your progress and reviewing your compliance. In addi- 
tion, you may need to hire an outside firm to validate or audit your 
process. For example, ITAA was brought in to validate and certify 
Prudential's year 2000 process. Also determine a process to do spot 
checks on the code that is compliant. You may choose to hire a ven- 
dor to come in and perform this validation. Don't wait until 2000 
for validation. 

The key message that I am compelled to leave you with is that 
year 2000 is a problem of titanic proportions but information tech- 
nology controls only the tip. The remaining is the unseen. The risks 
include business partners, software providers, and your desktops. 
We can do the best job. We can do the fixes. We can do all of that, 
but we cannot do it alone. We have got to have the unwavering 
support of our executives. It was an unseen portion of the iceberg 
which struck Titanic below decks. That doomed everyone aboard. 
My grave concern is that the leaders of too many organizations will 
and have dismissed the criticalness of the year 2K. In my opinion, 
the year 2000 is a sink or swim proposition. 

Flowever, being somewhat of an optimistic person, I'd like to 
leave you with a different message. During the Apoiio 13, j im 
Lovell said, "Flouston, we have a problem." And it was because 
they were smart and strategic that their lives were saved. I will 
now say, "Washington, we have a problem. It's the year 2000. I be- 
lieve you will be smart and strategic but you must understand 
what that means and be prepared by having contingency plans." 

I n closing, it would be impossible for me to overstate the size and 
scope and challenge that the Federal Government has, and its obli- 
gation to the citizens of this great Nation, as leaders. We Ameri- 
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cans must take the lead on the year 2000. We must set an example 
for other countries. We must demonstrate with decisive action the 
bold measures to follow. I urge you to take swift action on your 10 
action steps. 

Mr. Portman and Subcommittee Members, thank you for giving 
me the opportunity to speak with you today. It is, indeed, an honor 
for Prudential to be invited to contribute to the public dialog on 
what will surely be the defining moment at the end of the 20th 
century, not only for the United States, but the world. 

This concludes my testimony. 

[The prepared statement follows:] 

statement of Irene Dec, Vice President, Information Systems, Corporate 

Information Technolo^; and Manager, Year 2000 Program, Prudential 

I nsurance Company of America 

Congresswoman J ohnson and members of the committee: 

My name is Irene Dec and I am a Vice President of Corporate Information Tech- 
noiogy at Prudentiai. I am the Prudentiai Year 2000 Program Manager, ieading the 
company-wide Program Office. It is my responsibiiity to work with aii of 
Prudentiai's Business Groups and Corporate Functions to bring the entire enter- 
prise to Year 2000 compiiance. I am pieased to have this opportunity to present 
Prudentiai's experiences regarding the magnitude of the Year 2000 probiem. In the 
time you've given me, I'd like to discuss the strategies Prudential is using to solve 
the Year 2000 problem. I also will discuss how these strategies might be applied 
to other large organizations. 


Introduction 

First, some background on Prudential. We are one of America's largest insurance 
and financial services companies, with a presence in every state of the union and 
offices abroad. As of December 31, 1997, our statutory assets were $194.0 billion 
and we had $37 billion in revenues on a GAAP basis. We employ almost 80,000 peo- 
ple and serve nearly 40 million customers worldwide. Our gross 1997 information 
technology budget was approximately $1 billion. 

Because of Prudential's size and scope, the magnitude of our Year 2000 problem 
is monumental. We were fortunate that our Chief Executive Officer, Art Ryan, and 
our Chief Information Officer, Bill Friel, recognized the seriousness of the problem 
and identified it as a priority. Also, Prudential's senior management team sees Year 
2000 as a business issue not as a technology nuisance. Early on, Prudential realized 
the potential business risk represented by Year 2000, and sought to manage that 
risk intelligently. Year 2000 is a risk to all businesses. It is essential for all organi- 
zations to run Y2K projects with a sound risk management philosophy. 

Too Late to Start Early 

As of today, there are exactly 603 days left until we reach the Year 2000. That 
includes only 86 weekends. At this point, it is simply too late to start early. We 
began addressing the Y2K issue at Prudential in 1995. While we are confident we'll 
meet our objectives, we are not wasting one single day. This is the ultimate informa- 
tion technology deadline. And unfortunately, information technology professionals 
are widely regarded by our corporate colleagues as people who cannot meet dead- 
lines. 

It is time to move beyond awareness of the Y2K problem. It is time to take action. 

Risk Management Actions 

For those organizations that have not moved aggressively on the Y2K project, the 
following risk management actions should be considered: 

1. Secure Executive Commitment 

Identify the Year 2000 project as the most critical project within your organiza- 
tion, and secure unwavering executive commitment to it at once. 

2. Estabiish a Year 2000 Program Office 

Implement a Year 2000 Program Office immediately and assign your best people 
to the project. 
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3. Identify Critical Applications 

Identify your most critical applications, those that have the greatest impact on the 
business and on people. Focus your efforts on achieving Year 2000 compliance for 
those critical applications first and foremost. 

4. Stop All Other Prqiects 

Place all other systems work on hold until your Year 2000 project is completed. 
At this point, there isn't time for anything else. You cannot afford to take your focus 
off the Year 2000 goal. The Y2K project cannot be done along with other projects. 
Y2K takes complete and total priority. 

5. Dei/oteTime to Testing 

Testing for Year 2000 will require three times the normal procedures since the 
organization will have to test before Year 2K, as the century turns, and on critical 
dates, such as Leap Year and the first working day of the year. Allow sufficient time 
for testing. Approximately 50% of the Year 2000 project will be spent on testing. 
Organizations must set up Year 2K simulated testing environments for networks, 
distributed applications and mainframes. 

6. De/elop Contingency Plans 

If the risk is high that your organization may not get done with its Year 2000 
project in time, a contingency plan is critical. You must build manual processes to 
do the work and you must communicate to the people who are impacted. Do not 
wait until you have missed Year 2000 target dates to communicate. Tell people how 
you plan to handle the work in the interim and what they can expect. 

7. Re/ie/v and Assess Business Partner Risks 

One of the greatest risks to Y2K projects is an organization's business partners, 
including software vendors and other suppliers. Take time to review all software 
products and identify those that require version upgrades in order to become Y2K 
compliant. Identify software vendors that put your organization at risk for non- 
compliance and prepare contingency plans for alternative software replacements. 
Also, identify the processes required to maintain critical business functions. 

S. Validate Desktops 

Testing and validating applications and systems, software and hardware are ex- 
tremely important. Equally critical is assessing and validating end user desktop 
compliance. Many business decisions are based on calculations performed on spread- 
sheets and databases on personal computers. Your Y2K plan must include a process 
to ensuring that every desktop in the organization is Year 2000 compliant. 

To be successful in their Y2K initiatives, organizations must run this project dif- 
ferently than they have ever run anything before. Year 2000 cannot be managed as 
just another normal information technology maintenance project. It must be run 
from a dedicated, organization-wide Program Office and it must call upon the skills 
of your very best people. 


Year 2000 Strategic Decisions 

At Prudential, we developed our Year 2000 strategy around several key decisions. 

I 'd like to take some time to walk through these decisions to show you how we built 
our strategy and how it is moving us toward Year 2000 compliance. 

1. Define Organizational Structure 

First, we defined our organizational structure. We created an Enterprise-wide 
Year 2000 Program Office. Because Prudential has multiple lines of business, such 
as Individual Insurance, FlealthCare and Securities and Investments, for example, 
we also created Year 2000 Program Offices in each one of our Business Groups. The 
Business Group Program Offices report to the corporate-wide Y2K Program Office, 
which I manage. Any large organization that encompasses diverse activities should 
consider this approach. 

Once we had our structure in place, we staffed the Program Offices with our best 
p^le. And we staffed it sufficiently. You can't expect to meet the Y2K deadline 
with staff members who can only devote a percentage of their time to the fix. Our 
Program Office employees are dedicated full-time to achieving Y2K compliance. To 
meet the extraordinary manpower demands Prudential's Year 2000 problem pre- 
sents, we also brought on board contractors and consultants to assist us. 
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2. Identify Operating Principles 

With the Program Office estabiished, we were abie to identify standard operating 
principies. These are the ruies and r^uiations of how we'ii manage our Year 2000 
initiative. For exampie, there are basicaiiy two ways to fix the Year 2000 issue fieid 
expansion or windowing. One is to actuaiiy expand the fieid from two position year 
to four positions. The other is to buiid iogic into the code that fixes the probiem. 
Rather than ask our individuai Business Groups to make this decision for them- 
seives, Prudentiai's Y2K Program Office made the decision that is mandated across 
the entire company. We have selected the windowing technique. 

By estabiishing Operating Principies up front and by setting a company direction, 
we've reduced indecision and unnecessary anaiysis throughout the company. There 
is no waffiing on important standards because they've ai ready been set by the En- 
terprise-ievei Program Office. Thanks to our Operating Principies, there's iess op- 
portunity for wasting time. 

There wiii be exceptions to any Operating principies that are estabiished. We an- 
ticipated that and buiit a process wherein our Business Groups may present specific 
cases, based on business reasons, for making exceptions to the Operating Principies. 
As a resuit, we've granted some exceptions. 

Prudential's Operating Principles are 

• Aii existing appiications wiii require a Year 2000 certification for compiiance. 

• New software (purchases and internai development) will be certified before pur- 
chase and installation. 

• Rigorous risk and cost analyses will determine whether Prudential applications 
should be repaired or replaced. 

• Redundant applications will be consolidated where appropriate. 

• Replacement applications have been targeted for December 1998. 

• Parallel development activities will be carefully researched and assessed to en- 
sure against jeopardizing the timely success of Year 2000 maintenance. As I rec- 
ommended earlier, your organization's entire IT team should have one common and 
central purpose: to become Year 2000 compliant in time to avert disaster. You 
should be working on nothing else until Y2K is solved. 

• Standard date formats established by the Year 2000 Team will be employed in 
new development. 

• Date "windowing" (the logic approach) will be employed when renovating exist- 
ing applications. 

• Application replacement projects will be scheduled for completion by December 
1998. Dual strategy (i.e. renovation) will be required for any projects that will not 
meet that target. 

• Select vendors have been approved for the Year 2000 assessment and renova- 
tion work at Prudential. 

3. Complete Strategic Portfolio Analysis 

I n deciding how you'll tackle your Year 2000 problem, you might want to consider 
the approach of triage. Ask yourself three questions about your existing applications 
and systems: Should we renovate or fix it to make it Y2K compliant? Should we 
replace it with something new? Should we just retire it, since we aren't even using 
it anymore? 

At Prudential, our Year 2000 Program Office looked at every one of our 1,533 ap- 
plications and decided to renovate 1,035 of them. With a total of more than 170 mil- 
lion lines of code, we are working on fixing about 97 million of them. Our decision 
was to renovate 75% of our existing applications. We decided to replace 12% and 
reti re 13%. 

At this point, however, replacement strategies are high-risk. It is too late to begin 
a replacement/new development project, unless the project has been targeted for 
completion by 1998. The better approach would be to consider a renovation strategy 
and begin immediately. 

Organizations should not allow illogical rationale to creep into their Y2K decision 
making. Some are saying that they don't need to fix particular applications because 
they will just replace them. But remember, everyone in the IT industry is notori- 
ously bad about meeting target dates even software vendors. If the replacement is 
not intensely controlled, there's a potential risk you will not be done on time. Orga- 
nizations can't take that chance. It is better to go straight to renovation. Select sys- 
tems or applications that are most critical those with a health impact or a financial 
impact. I n the case of the federal government, they are the applications and systems 
that will affect the quality of life of American citizens. In the case of Prudential, 
we determined that the applications that are most critical to us are the ones that 
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touch our customers. Those applications became our priorities and we scheduled 
them first. 


4. Implement Communications Strategy 

The fourth step in Prudential's Year 2000 Strat^ic decision-making process was 
to create a process for communicating about our initiative. Organizations need to 
communicate to two groups. One is the information technology community. They 
need to be aware of directions, tools, achievements, expectations and the like. The 
second group you must communicate with is all employees. Year 2000 impacts every 
desktop in your organization. Employees and associates need to know what changes 
they can expect and what they must do to cooperate with Y2K strategies. 

At Prudential, we use every means of communication available to us to reach 
these two important constituents. We produce a quarterly newsletter and send E- 
mail messages out on a regular basis. We have established databases to share infor- 
mation and to answer frequently asked questions about Y2K. 

We are also addressing the subject of external communication to the public, and 
most important, to our customers and business partners. 

5. Identify Staff Retention Approach 

Another important step in our Y2K strategy was acknowledging that staff reten- 
tion would be an issue and developing an approach to keeping our people with us. 
There is a huge demand for coders, project managers, program managers and qual- 
ity testers. I told you that at Prudential, we put our best people on our Year 2000 
effort. We do not want to lose them. We used approaches to motivate our best and 
brightest to stick with us in the face of tempting offers from other organizations. 

Our retention strategy is to offer bonuses to individuals who stay with us in our 
Y2K effort. It is a strategy that many companies are using successfully and we de- 
cided to adopt it. Enriching compensation may not be an option for some organiza- 
tions, including the government, perhaps. But money is not the only incentive to 
stick with a job. Take a look at your people and what motivates them. Offer the 
awards that will have meaning to the people in your organization. It might be in- 
creased vacation time, a promotion, training, flexible scheduling or a number of 
other lower-cost options your organization can comfortably offer. 

6. Select External Service Providers 

An organization needs to make a decision as to which components of the Year 2K 
program their own employees will work on and which will be handled either outside 
the company or by external contractors who may work on-site. General categories 
include program and project management, assessment, code fixing and testing. 
Prudential's decision was to outsource about 65% of code fixing to outside providers. 

In selecting your service providers, it is too late to spend a lot of time on RFPs 
(Requests For Proposals) and RFIs (Requests For Information). Therejust isn't time 
now. Choose providers with whom you've already established partnerships, whose 
work is proven and whose people you trust. 

Using outside providers will save your organization time. Many have an auto- 
mated tool set that allows their people to come in and fix your code in a fraction 
of the time it might take your own employees who don't have those advanced tools 
available. Automated tools reduce the chance for error and give you more time to 
work on testi ng. 


7. Identify Standards 

One key step in Prudential's Y2K strategy was to identify standards for tools, 
methodology, certification and renovation. J ust as we saw the advantages of estab- 
lishing company-wide Operating Principles, we also saw the need to identify stand- 
ards that would apply throughout the company. This saves analysis time, as we've 
seen. It also gets everyone on the same page. With a standard tool set and meth- 
odology, for example, we can also obtain consistent metrics and data for reporting 
purposes. And by applying the same standards for certification across the Enter- 
prise, we have reduced our Year 2000 risk. 

8. Identify Renovation-Fix Strategy 

There are two ways an organization can fix the Year 2000 code problems. One 
is to actually expand the field from two position years to four positions. The other 
is to build logic into the code that fixes the problem. This can not be a decision made 
by individual programmers. Your Program Office must decide which solution is right 
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for the entire organization. At this point, however, thefieid expansion fix may not 
be an option, since it takes ionger to do and to test. And it costs more. 

9. Implement Proj ect T racking and Reporting 

It is May 7, 1998. Do you know where your Year 2000 project is? 

Doing the work is criticai, but tracking your progress is equaiiy important. In a 
large organization, tracking and reporting are key strategies for Y2K success. The 
most meaningful method for project tracking gauges "planned" versus "actual" ac- 
complishments. Status reports that summarize what people did that week or month 
are worthless, if they are not tagged to a planned completion date. Prudential's Year 
2000 Program Office set milestones for accomplishing specific objectives. Our people 
have to track their accomplishment based on those established milestones. We've 
built in checkpoints to validate that we are always on target to meet our long-range 
goals. Perhaps most important, we report on a monthly basis. This is absolutely crit- 
ical if your aim in reporting is to give senior management the opportunity to do 
some course correction, if the metrics warrant it. 

Following are the five milestones we've identified on the project: 

• Not started 

• Assessment phase 

• Code fix 

• Testing 

• Certification complete and back in production. 

Meticulous tracking and reporting with real accountability attached is one of the 
best ways to reduce the risk of failure. Antiquated tracking methods or haphazard 
reporting are unacceptable for the Year 2000. Large organizations, especially, must 
rely on sophisticated metrics and tools to track their Y2K projects. 

10. Conduct Certification Procedures 

A certification process is critical. Prudential has established its own certification 
process to assure that all our Business Groups and Corporate Functions meet our 
standards for Year 2000 compliance. Organizations can not take a chance that Y2K 
compliance is compromised on any front. You cannot rely on an individual's assur- 
ance that the application will be ready to go. You need definitive, objective measures 
that demonstrate without a shadow of a doubt that all of your applications are func- 
tioning properly, in completeY2K compliance, both beforeY2K and after. 

In addition to creating our own 15-point Y2K compliance certification procedure. 
Prudential has obtained certification from the Information Technology Association 
of America (ITAA) for its Year 2000 program. The ITAA certification process is an 
excellent means for determining whether or not an organization has an effective 
Y2K process in place. 


11. Identify Contingency Plans 

Since Year 2000 is a business management risk, it requires a business continu- 
ation plan. Organizations need to look at the potential for high risk to the company 
and its constituents and create contingency plans for critical business functions. 

Contingency planning goes beyond applications. You must also prepare contin- 
gency plans around infrastructure, including all your data centers, computers, build- 
ings and facilities, and your telecommunications. In addition, you must have contin- 
gency planning in place as it relates to your business partners and suppliers. 

12. I nventory Business Partners and Suppliers 

One of the greatest risks to an organization is its Y2K vulnerability with business 
partners and suppliers. You can control your own applications and systems. You can 
have an airtight business continuation plan in place. But if your critical business 
partners and suppliers fall short on delivering Y2K compliance, that could have seri- 
ous repercussions for your organization. At Prudential, we identified our critical 
business partners and suppliers and surveyed them to determine their ability to 
meet Y2K compliance. We put together a risk assessment team to help us determine 
for sure whether our business partners and suppliers meet our Y2K standards and 
to replace or assist those that do not meet our expectations. 

13. Determine Financial Tracking 

J ust as you track how you are progressing on your Year 2000 project, you should 
also track how much it is costing the organization. You must identify those costs 
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that are associated with Y2K and establish a mechanism for tracking your organiza- 
tion's financial commitment to the project. 

14. Develop a Process for Responding to Inquiries 

One of the things that has helped Prudential's Year 2000 Program is our propen- 
sity to develop a process to handle everything related to our work. As part of our 
Y2K process, we receive inquiries and surveys from our business partners, including 
the government, our suppliers, and our customers, asking us about our procedures. 
In order to streamline our responses and to track them effectively, we created a 
process and developed legally approved language to help us answer questions quick- 
ly and consistently. We track these inquiries in a database to make sure they are 
answered in a timely, appropriate way. 

A Problem of Titanic Proportions 

That is a summary of the strategic decisions Prudential and any other large orga- 
nization must make in order to orchestrate a successful Year 2000 transition. This 
is a huge undertaking for our company and for every organization and industry 
around the globe. No one has ever had to do an IT project of this size and scope 
before, and it will be a significant challenge to our industry. 

But one key message I am compelled to leave with you is this. Year 2000 is an 
issue of Titanic proportions, but information technology controls just a tip of the ice- 
berg. The remaining and often unseen risks include business partners, software ven- 
dors and the validation of the desktop environment. 

Prudential executives support Year 2000 as a critical business issue. They realize 
that technology is so integrated into our products and services that Year 2000 is 
an issue in which each employee has a stake and makes a contribution. 

We in the information technology department can run the Y2K Program Offices, 
manage the projects and fix or replace the code. We can test for compliance and pre- 
pare the organization for J anuary 1, 2000 and beyond. But we can't do it alone. 
We've got to have the unwavering support of our top executives and the understand- 
ing and cooperation of every employee in the organization and every one of our busi- 
ness partners. 

It was the unseen portion of the iceberg, which struck Titanic below-decks, that 
doomed everyone aboard. My grave concern is that the leaders of too many organiza- 
tions will dismiss the critical nature of the Y2K project. They may overestimate the 
ability of their already stretched information technology staff. Or perhaps, they will 
underestimate the amount of work and resources needed to become Year 2000 com- 
pliant by the deadline. It's a deadline that is imposed by the relentless force of time 
the toughest taskmaster of them all. 

Failure Is Not An Option 

In my opinion, the Year 2000 problem is a sink or swim proposition. But because 
I am, by nature, an optimist, I prefer to leave you with a different image of Y2K. 

When J im Lovell, the commander on the ill-fated Apollo 13 mission, uttered those 
immortal words, "Flouston, we have a problem," he wasn't kidding. 

For us at Prudential, and for any organization that plans to succeed into the 21St 
century, failure is not an option. Those were the confident and determined words 
of Gene Kranz, Mission Control Chief, who was largely responsible for returning the 
astronauts safely to Earth. 

Flouston, "there is a problem." And its name is Year 2000. Yet, I believe if you 
are smart and strategic, if you make every second count from now until the clock 
strikes midnight on December 31, 1999, you will achieve your goals and survive this 
mission critical assignment. 

Because we at Prudential have zero tolerance for Y2K failure within our own or- 
ganization, we have zero tolerance for Y2K failure within any of our business part- 
ners' organizations. We are aggressively working with all our partners in fields as 
diverse as finance, law, medicine and government to ensure that Prudential's cus- 
tomers will not feel so much as a tremor when we collectively blast into the new 
millennium. 


Conclusion 

That is why, in closing, it would be impossible for me to overstate the size and 
scope of the challenge the Federal government faces in preparing to meet its obliga- 
tion to the citizens of this great nation regarding Year 2000 readiness. As world 
leaders, we Americans must take the lead in Y2K compliance. We must set the ex- 
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ample for other countries to follow. We must demonstrate with decisive action and 
bold measures that failure is not an option. 

I urge the Subcommittee on Oversight of the Committee on Ways and Means to 
take swift action on the eight risk management actions for successful Year 2000 
transition, which are: 

1. Secure Executive Commitment 

2. Establish a Year 2000 Program Office 

3. Identify Critical Applications 

4. Stop All Other Projects 

5. Devote Time to Testing 

6. Develop Contingency Plans 

7. Review and Assess Business Partner Risks 

8. Validate Desktops 

Congresswoman J ohnson and committee members, thank you for giving me this 
opportunity to speak with you today. It is indeed an honor for Prudential to have 
been invited to contribute to the public dialogue on what will surely be the defining 
moment of the end of the 20th century, not only here in the United States, but 
around the world. This concludes my testimony. 


Mr. PoRTMAN. Thank you, Ms. Dec. 

Ms. J ackson. 

STATEMENT OF J ENNIFER J ACKSON, GENERAL COUNSEL AND 
VICE PRESIDENT, CLINICAL SERVICES, CONNECTICUT 
HOSPITAL ASSOCIATION; ON BEHALF OF AMERICAN HOS- 
PITAL ASSOCIATION 

Ms. J ACKSON. Mr. Portman, I'm J ennifer J ackson, general coun- 
sel and vice president of Clinical Services at the Connecticut Hos- 
pital Association. And I 'm pleased to be here today on behalf of the 
American Hospital Association which represents nearly 5,000 hos- 
pitals, health systems, networks, and other providers of care. 

Hospitals and health systems are taking the year 2000 situation 
very seriously. They face the same potential problems as most 
other institutions and businesses. Their computer systems, their 
telecommunications systems, their security systems, their ele- 
vators, all could be affected by year 2000 problems. However, hos- 
pitals are unique places and they have the potential for unique 
problems primarily because of their heavy dependence on tech- 
nology and medical devices and equipment. 

In analyzing these potential problems, our priority is, as always, 
the safety of our patients and the delivery of high-quality patient 
care. There are several key players that can help prevent those 
problems from occurring. There are hospitals and their associa- 
tions, manufacturers of medical devices and equipment, the Food 
and Drug Administration, the Health Care Financing Administra- 
tion, and Congress. AHA and State hospital associations are work- 
ing together to ensure that our members know about the potential 
dangers of the millennium bug and they are taking steps to avoid 
problems. 

When it comes to medical devices and equipment, however, our 
efforts alone will not solve the problem. I nformation about whether 
or not these devices will be affected by the date change must come 
from the manufacturers of the equipment. We believe that existing 
regulations allow the FDA to require manufacturers to perform 
year 2000 testing and report adverse results. We urge the FDA to 
exercise its enforcement authority and we ask Congress to do ev- 
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erything in its power to enable the FDA to take the lead in ensur- 
ing that year 2000 information regarding medical devices gets from 
the manufacturers to those who need it the most— and that is the 
health care providers. 

We also need the help of the Health Care Financing Administra- 
tion. America's hospitals and health systems receive, on average, 
half of their revenue from government programs like Medicare and 
it is critical that the flow of these funds not be interrupted by year 
2000 problems. HCFA must r^uire its contractors to ensure that 
their performance will not be interrupted by the date change. Let- 
ting providers know what changes may be required of their billing 
systems is also important so that providers and contractors can 
work together to ensure that their systems are compatible. 

Of course, there also remains the possibility that unforeseen 
problems could occur so there should be a contingency plan. A sys- 
tem to provide periodic interim payments based on past payment 
levels is an ideal way to do this. 

Congress also has a key role to play. Your attention to this issue 
through hearings like this one reflects your understanding of the 
gravity of the situation. We ask you to help America's health care 
system to avoid year 2000 problems by taking several steps. First, 
Congress should appropriate whatever funds the FDA may need to 
ensure that manufacturers of medical devices investigate, report, 
and correct year 2000 related problems in their products. Second, 
Congress should consider enacting some form of immunity from li- 
ability for health care providers who have taken steps to prevent 
year 2000 problems. And, third. Congress should authorize the use 
of periodic interim payments under the Medicare Program. 

America's hospitals and health systems, their State associations, 
and the American Hospital Association are working together to pre- 
pare for the year 2000. We encourage Congress ancT our Federal 
agencies to work with us as well so that together we can ensure 
a smooth and healthy transition into the new millennium. 

Thank you. 

[The prepared statement follows:] 

statement of J ennifer J ackson, General Counsel and Vice President, 

Clinical Services, Connecticut Hospital Association; on behalf of 

American Hospital Association 

Madam Chairwoman, I amj ennifer J ackson, Generai Counsei and Vice President, 
Ciinicai Services, at the Connecticut Hospitai Association. I am here on behaif of 
the American Hospitai Association (AHA), which represents neariy 5,000 hospitais, 
heaith systems, networks, and other providers of care. 

We appreciate this opportunity to present our views on an issue that is of criticai 
importance to our members and the patients they care for: the potentiai for the 
"miiiennium bug"— the inabiiity of computer chips to recognize the Year 2000— to 
interrupt the smooth deiivery of high-quaiity heaith care. The AHA and its members 
are committed to taking whatever steps may be necessary to prevent potentiai Year 
2000 probiems from affecting patient care. 

Hospitais and heaith systems operate seven days a week, 24 hours a day. Their 
doors are aiways open because the peopie they serve trust that they wiii be there 
whenever the need arises. Our number one concern is the heaith and safety of our 
patients, and that is why I am here. 

Hospitais and heaith systems face the same potentiai probiems as most other in- 
stitutions. Ceiiuiar phones, pagers, security systems, eievators— aii couid be affected 
by Year 2000 probiems. However, hospitais are speciai pieces that aiso reiy daiiy 
upon unique medicai devices and equipment. We are concerned about the potentiai 
impact of Year 2000 computer probiems on patient safety— and hospitais, heaith 
care providers and their associations cannot reduce, iet aione eiiminate, that risk 
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by themselves. We need your help and cooperation, and that of the federal agencies 
that regulate the health care field: namely, the Food and Drug Administration 
(FDA) and the Flealth Care Financing Administration (FICFA). 

In particular, we need the federal government to exercise Its authority In this 
area— now. We need the federal government to create an atmosphere In which ev- 
eryone Involved In the health care field will view the full and timely disclosure of 
Year 2000 computer problems not only as diligent and prudent behavior— the right 
thing to do— but also as mandatory conduct. 

One of our primary concerns has to do with potentially non-compllant medical de- 
vices and equipment. Microchips (or microprocessors) that use date-sensitive logic 
are embedded In many medical devices, and we need to find out whether those de- 
vices will be affected by the date change to the Year 2000, and. If so, how we can 
fix them to avoid an Interruption or other malfunction. The manufacturers of these 
devices are the best and, and In some cases, the only source of this Information. As- 
suming that prudent medical device and equipment manufacturers are engaging In 
Year 2000 testing, we need to know what they are discovering, especially If they 
are uncovering problems. FI ere lies the heart of our concern. 

While we as health care providers can ask manufacturers to disclose Year 2000 
Information to us, we cannot force them to do so. We do not have the legislative 
or regulatory authority to compel disclosure. We believe that Is a job for Congress 
and the FDA. 


The Role of AFIA and State FIospital Associations 

Flospitals and health systems are trying to do their part. Across the nation, more 
and more hospitals are preparing for the date change, and making a commitment 
to take all appropriate steps to avoid any disruption In patient care. Continuing a 
tradition of partnership In addressing Issues that affect our mutual members, the 
AFIA and the nation's state hospital associations are working together to Inform and 
educate hospitals and health systems about the Year 2000 Issue. 

We are committed to ensuring that our members are aware of the dangers of the 
millennium bug. We can make sure they have the latest Information on what their 
colleagues and other organizations are doing to address the problem. And we can 
help them learn about solutions that can help them. 

Our State Issues Forum, which tracks state-level legislative and advocacy activi- 
ties, Is hosting biweekly conference calls dedicated entirely to the Year 2000 Issue. 
On these calls. Information Is shared among and between states and AFIA staff. A 
special AFIA task force on the Year 2000 problem has been drawing up specific 
timelines for action to make sure our members get the latest Information and know 
where to turn for help. 

Articles are appearing regularly In AFIA News, our national newspaper. In Flos- 
pitals and Flealth Networks, our national magazine for hospital CEOs, In Trustee, 
our national magazine for volunteer hospital leadership, and In several other na- 
tional publications that are published by various AFIA membership societies. Sev- 
eral of these societies, such as the American Society for FI ealthcare Engineering and 
the American Society for FI ealthcare Risk Management, are deeply Involved In help- 
ing their members attack the millennium bug In their hospitals. 

1 n addition, the AFIA Web site has become an Important clearinghouse of Informa- 
tion on the Year 2000 Issue, Including links to other Web sites that also have Infor- 
mation that can help our members. 

The Role of the Food and Drug Administration 

When It comes to medical devices, however, our efforts are not going to be suffi- 
cient to solve the problem, unless the manufacturers cooperate fully and quickly. 
While we anticipate that the number of devices that are affected may be limited, 
it is critical that accurate and thorough information be available from manufactur- 
ers. Flealth care providers must inventory their thousands of devices and pieces of 
equipment. But information about whether these devices are Year 2000-compliant— 
that is, whether or not they will be affected by the date change— must come from 
the manufacturers. The FDA has a key role to play in this area. 

The Center for Devices and Radiological Flealth (CDRFI), the arm of FDA respon- 
sible for regulating the safety and effectiveness of medical devices, has taken a num- 
ber of steps to ensure that manufacturers of medical devices address potential Year 
2000 problems. We commend the center for its actions. Dr. Thomas Shope, who is 
heading FDA's efforts, has been very receptive to our concerns. We believe that cur- 
rent regulations allow the FDA to require manufacturers of medical devices to per- 
form Year 2000 testing and report adverse results. We urge that FDA be given 
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whatever resources or support it may need from Congress to exercise its enforce- 
ment authority in this area. 

The Role of the Health Care Financing Administration 

On average, America's hospitais and heaith systems receive roughiy haif of their 
revenues from government programs iike Medicare and Medicaid. If that much reve- 
nue were to be suddeniy cut off, hospitais couid not survive, and patient care couid 
be jeopardized. Hospitais wouid not be abie to pay vendors. They wouid not be abie 
to purchase food, suppiies, iaundry services, maintain medicai equipment— in short, 
they wouid not be abie to do the job their communities expect of them. Aii this 
wouid occur even as hospitais and heaith systems faced the substantiai costs of ad- 
dressing their own Year 2000 system needs. 

HCFA must make sure its contractors have taken steps to ensure that their per- 
formance wiii not be interrupted by Year 2000 probiems caused by the miiiennium 
bug. HCFA shouid make readiiy avaiiabie its work pian for bringing the contractors 
into compiiance and aggressively monitor their efforts. Letting the providers know 
what changes may be required of them is aiso important. This wouid aiiow both pro- 
viders and contractors to prepare simuitaneousiy and ensure that their systems are 
compatibie. 

Even if aii contractors express confidence that their payment mechanisms wiii not 
be affected by the miiiennium bug, the possibiiity remains that unforeseen probiems 
couid crop up. Therefore, HCFA shouid estabiish a contingency pian in case contrac- 
tors' payment mechanisms somehow faii at the turn of the century. 

Medicare beneficiaries' heaith care needs wiii remain constant, regardiess of 
whether we are prepared for Year 2000 probiems. If carrier and fiscai intermediary 
payment systems are dogged up by the miiiennium bug, hospitais' abiiity to con- 
tinue providing high-quaiity heaith care couid be severely affected. A system to pro- 
vide periodic interim payments, based on past payment ieveis, is one way that this 
couid be done. It would ensure that hospitals have the resources necessary to care 
for Medicare patients. 

And let me add that Medicare is certainly not the only payer for hospital services. 
Similar payment delays could occur if private health insurers and, in the case of 
Medicaid, individual states, have not addressed their own Year 2000 problems. The 
federal government has the power to prevent this from happening, and we urge you 
to use that power. 


The Role of Congress 

As I have described, health care providers and the associations that represent 
them are devoting significant time, resources and energy to preventing potential 
Year 2000 problems from affecting patient safety. It is essential that we all look for 
ways to help prepare America's health care system for the turn of the century, and 
Congress can play an important role. Your attention to this issue, through hearings 
such as this, reflects your understanding of the gravity of the situation. 

We ask you to help America's health care system avoid Year 2000 problems by 
taking several steps that relate to the issues I have described: 

• Congress should appropriate whatever funds are necessary for the FDA to en- 
sure that manufacturers of medical devices investigate and correct Year 2000- 
related problems in their products, and report the results in a timely fashion to the 
FDA and to the users of thei r products. 

• Congress should enact some form of immunity from liability for health care pro- 
viders that have taken steps to prevent Year 2000 problems from affecting patient 
care— for example, relying on the FDA's data base of medical devices and equipment 
for information about Year 2000 compliance. To a great extent, hospitals must rely 
on manufacturers of medical equipment and devices— and on vendors providing 
other systems and products— to disclose whether a Year 2000 problem may arise, 
and how to correct the problem. In addition, some products and systems may have 
been purchased by hospitals years ago, before the Year 2000 date change became 
a consideration. Providers should not be liablefor damages for theYear 2000 limita- 
tions of those products and systems. 

• Congress should authorize the use of periodic interim payments under the 
Medicare program. These payments, based on past payment levels, should be imple- 
mented to ensure adequate cash flow for providers in case carrier and fiscal inter- 
mediary payment systems fail due to the date change. 

Madam Chairman, the Year 2000 issue will affect every aspect of American life, 
but few, if any, are as important as health care. America's hospitals and health sys- 
tems, their state associations, and the AHA are partners in the effort to prepare 
for the Year 2000. We encourage Congress and our federal agencies to work with 
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us as well. Together, we can ensure a smooth— and healthy— transition Into the new 
millennium. 


M r. PoRTMAN . Thank you, M s. J ackson. 

Ms. Lehnhard. 

STATEMENT OF MARY NELL LEHNHARD, SENIOR VICE 

PRESIDENT, POLICY AND REPRESENTATION, BLUE CROSS 

AND BLUE SHIELD ASSOCIATION 

Ms. Lehnhard. Congressman Portman, I'm Mary Nell Lehnhard, 
senior vice president of the Blue Cross and Blue Shield Association. 
I appreciate the opportunity to testify on behalf of the 38 Blue 
Cross and Blue Shield plans that are part A intermediaries and the 
21 plans that are part B carriers. 

Medicare is administered through a very successful partnership 
between private industry and HCFA. Blue Cross and Blue Shield 
plans process 85 percent of part A claims, and about two-thirds of 
all part B claims. Medicare contractors have successfully met many 
significant challenges through this 33-year partnership. Contrac- 
tors have been able to handle a dramatic increase in workload from 
about 60 million claims in 1970 to about 900 million claims in 
1998. We process more than 3 million claims every working day. 
Contractors have handled major challenges in the past, implement- 
ing programmatic changes quickly, including Medicare prospective 
payment systems for hospitals in the eighties, the physician 
resource-based relative value scale in the nineties, and the many 
complex payment changes in BBA, the Balanced Budget Act, in 
1997. These complex undertakings were accomplished in extremely 
tight timeframes and were successful. 

Our next challenge is assuring that year 2000 computer adjust- 
ments are made accurately and in accordance with the timetable 
set out with HCFA. I want to state very clearly that Medicare con- 
tractors are committed to year 2000 compliance. Despite the very 
real challenges, let me assure you that contractors are working to- 
ward becoming compliant on a timetable that will meet HCFA's 
deadline of December 31, 1998, which is actually 2 months earlier 
than the governmentwide target set by 0MB. 

Blue Cross and Blue Shield Association and our contractors have 
been working closely with HCFA on all the compliance issues. I 
would note that two circumstances have made year 2000 compli- 
ance even more challenging for our contractors. First, there's been 
a significant change in how contractors are to proceed in assuring 
millennium compliance. Originally, many of the system changes 
that would have been necessary for compliance were to be accom- 
plished through the conversion of all the contractors to the Medi- 
care Transaction System, MTS. As you know, MTS was dropped 6 
months ago and, as a result, contractors that would have been 
making significant changes, in the absence of MTS, they are behind 
because they've totally switched directions. Also, instead of convert- 
ing to the MTS system. Medicare contractors are now transitioning 
to a single part A system and a single part B system. In some 
cases, this has made it difficult to focus on millennium compliance. 
It's a diversion of resource, a diversion of expertise, and several 
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contractors have asked HCFA to delay these major transition re- 
quirements so they could focus on the year 2000 issues. We're very 
pleased that just last week HCFA agr^ to delay transition to the 
single system for some plans. 

Funding is also an issue. We have yet to receive any funding for 
our transition activities— our compliance activities. We anticipate 
that the year 2000 compliance will be very costly and, in the ab- 
sence of allocation of funds, we've had to reallocate funding from 
other important activities to support our compliance activities. 
We're very pleased that Congress actually reprogrammed $20 mil- 
lion in the fiscal year 1998 supplemental appropriations bill to 
cover our millennium costs but given the very high cost of compli- 
ance, more funding is going to be necessary. 

Finally, I'd note that HCFA has been seeking legislative author- 
ity to dramatically restructure the Medicare contracting process ar- 
guing that contractor reform is necessary to achieve compliance. 
Given our efforts to work cooperatively with HCFA on the issue, 
and the very broad authority that HCFA has under current con- 
tracts, we're perplexed about why HCFA is asking for contractor 
reform to support year 2000 compliance. Contractor reform 
wouldn't address year 2000 compliance issues. New contractors are 
going to face the same difficulties as current contractors, including 
compliance dates that are 2 months earlier than many subcontrac- 
tors they depend on that also have government contracts. In fact, 
contractors unfamiliar with Medicare would have the added burden 
of learning its extremely complex rules and regulations while si- 
multaneously working to achieve millennium compliance. Also, 
given the overwhelming current responsibilities from BBA and 
HIPAA, the Health Insurance Portability and Accountability Act, 
we don't believe the agency has the resources or staff to implement 
any additional activities such as new procurement. And, finally, 
HCFA has very broad authority under current law, and can termi- 
nate contractors for nonperformance including failure to meet the 
year 2000 timetable. In fact, HCFA has already put us on notice 
that this is the standard for compliance with the program. 

The Ways and Means Subcommittee on Health has reviewed and 
rejected similar proposals for new authority in the past and my tes- 
timony details our specific concerns with the reform legislation 
such as preempting the Secretary from the competitive bidding 
process under the Federal acquisition regulations. 

In summary, contractors are working diligently to become com- 
pliant by December 1, 1998. It's a monumental task but contractors 
are committed to meeting these challenges just as they have met 
past challenges. And we believe Congress should reject HCFA's use 
of 2000 compliance as a reason for legislating far-reaching changes 
in the program. I n fact, contractors reform at this time would intro- 
duce major change, confusion, and diversion of resources at a time 
when experience and focus is extremely important. 

Thank you. 

[The prepared statement follows:] 

statement of Mary Nell Lehnhard, Senior Vice President, Policy and 
Representation, Blue Cross and Blue Shield Association 

Madam Chairman and members of the subcommittee, I am Mary Neii Lehnhard, 
Senior Vice President of the Biue Cross and Biue Shieid Association, the organize- 
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tion representing 55 independent Biue Cross and Biue Shieid Pians throughout the 
nation. I appreciate the opportunity to testify before the subcommittee on the efforts 
of Medicare contractors to ensure that Medicare computer systems wiii function 
properiy beyond the year 2000. 

The Medicare program is administered through a successfui partnership between 
private industry and the Heaith Care Financing Administration (FICFA). Since 
1965, Biue Cross and Biue Shield Plans have played a leading role in administering 
the program. They have contracted with the federal government to handle much of 
the day-to-day work of paying Medicare claims accurately and in a timely manner. 
Today, Blue Cross and Blue Shield Plans process 85 percent of Medicare Part A 
claims from hospitals, nursing homes, and other institutional providers, and about 
two-thirds of all Part B claims from physicians, labs, durable medical equipment 
and other health care practitioners. 

Medicare contractors have successfully met many significant challenges during 
this thirty-three-year partnership. Medicare contractors, for example, have been 
able to handle a dramatic increase in workload. The number of Medicare claims has 
increased almost 15 fold from 61 million claims in 1970 to an estimated 889 million 
in 1998. Today, Medicare contractors process more than 3 million claims every 
working day. 

On top of this massive growth in workload, contractors have handled other major 
challenges such as quickly implementing major programmatic changes, especially 
over the last 15 years. These changes to the Medicare program include: the institu- 
tion and refinement of the Medicare prospective payment system for hospitals in the 
mid-1980s, the physician resource-based relative value payment system in the 
1990s, and the many new payment system changes that are required by the Bal- 
anced Budget Act of 1997. These critical undertakings were accomplished in ex- 
tremely tight time frames. We are very proud of our role as Medicare administra- 
tors, and our record of efficiency and cost effectiveness for the federal government. 

My testimony today focuses on one of our next major challenges assuring that 
Year 2000 computer adjustments are made accurately and in accordance with the 
timetable set out by FICFA. Specifically, I will discuss: 

• Medicare contractors' commitment to becoming Year 2000 compliant; 

• Our efforts with FICFA to ensure compliance: 

• Other factors affecting contractor compliance: and 

• Why Medicare contractor reform is not necessary to assure compliance. 

I . Medicare Contractors Are Committed To Year 2000 Compliance 

I want to state clearly that Medicare contractors are committed to Year 2000 com- 
pliance. In recent congressional hearings and press reports, it has been suggested 
that contractors are not being diligent in their efforts to meet this requirement and 
that FICFA needs additional authority to assure compliance. Nothing could be fur- 
ther from the truth. The confusion may be the result of a discussion between FICFA 
and contractors regarding a contract amendment, and I will say more about that 
later in my testimony. 

Year 2000 compliance is a top priority for Medicare contractors. Despite the real 
challenges, let me assure you that Medicare contractors are working toward becom- 
ing compliant on a timetable that will meet FICFA's deadline of December 31, 1998, 
which is two months earlier than the government-wide target date set by Office of 
Management and Budget (0MB). 

Medicare contractors will make every effort to meet this challenge just as they 
have successfully met other challenges in the past. It is in everyone's interest Blue 
Cross and Blue Shield Plans, the government, providers and beneficiaries for con- 
tractors to become millenium compliant. For Blue Cross and Blue Shield Plans, both 
their Medicare and private business depend on meeting this challenge. 

II . Our Efforts With FICFA To Ensure Compliance 

BCBSA and Medicare contractors have been working closely with FICFA on com- 
pliance issues. As part of this process, BCBSA has been working with FICFA to find 
an agreeable contract amendment related to Year 2000 compliance. I want to dis- 
cuss the circumstances surrounding this amendment. 

Last fall, FICFA sent all Medicare contractors a contract amendment intended to 
assure Year 2000 compliance. The proposed amendment required Medicare contrac- 
tors to be Year 2000 compliant by December 31, 1998 two months ahead of other 
government contractors. The amendment also defined FICFA's expectations of Medi- 
care contractors with regard to Year 2000 compliance. 

While we fully support FICFA's efforts to address the Year 2000 issue in a timely 
fashion, BCBSA raised several questions about the proposed amendment. We did 
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not have a problem with being compliant earlier than other government contractors, 
but we did raise several problems, such as contractors' dependence on vendors, 
which is described below. Plans and contractors believed that no entity would le- 
gally be able to sign the proposed amendment, and we asked that it be modified. 
We had thefollowing concerns: 

• BCBSA pointed out that it would be impossible to provide HCFA the assurances 
for Year 2000 compliance that the contract amendment would have required be- 
cause "full" compliance depends on other businesses. Examples of other businesses 
that contractors will depend on for compliance are manufacturers of microchips, 
banks, and the claims systems that are owned and maintained by doctors' offices 
and hospitals. The problem is that all of these entities are following varying compli- 
ance dates. If any one of these other entities has a later compliance date, then the 
Plan cannot be in "full" compliance. Since Medicare contractors cannot force third- 
party vendors to become compliant by a certain date, contractors would be in no po- 
sition to ensure full compliance. 

• A decision about compliance by the Securities and Exchange Commission (SEC) 
illustrates and adds to the problem we are raising. A recent SEC policy statement 
said that it is impossible for any entity to represent that it has achieved full Year 
2000 compliance before] anuary 1, 2000. Contractors would essentially be put in the 
position of forcing the compliance of public entities that have different timetables 
for compliance. This could pose significant problems. Based on our legal interpreta- 
tion of the amendment, even if our claims processing activities were compliant, we 
could have been considered noncompliant if, for example, our maintenance company 
for the elevators in a building we rent failed to assure compliance by December 31, 
1998. 

• The amendment also would have required that contractors certify the compli- 
ance of all vendors. Certification is a specific procedure that creates a civil or crimi- 
nal liability for contractors if the information is incorrect. Certification of Year 2000 
compliance would have required contractors to know all the facts about any entity 
that has any kind of relationship with the contractor (eg., all subcontractors in a 
building rented or owned by the contractor, all vendors and all vendor subcontrac- 
tors). Contractors would be subject to civil and criminal penalties if they certified 
compliance and were not in compliance through circumstances beyond their control. 
There are circumstances where contractors have to certify the validity of informa- 
tion (eg., financial statements). These are, however, situations where contractors 
are familiar with and know all the facts. But it is an unacceptable level of liability 
for us to certify that everyone contractors have a relationship with is Year 2000 
compliant. 

• In addition, the amendment would have allowed HCFA to prohibit Plans with 
Medicare contracts from entering into other Medicare contracts, such as managed 
care contracts or Medicare Integrity Program contracts, if they were noncompliant. 
We find no statutory basis for unilaterally debarring Plans with Medicare contracts 
from participating in other Medicare programs— especially programs such as 
Medicare-fChoice that are not part of the scope of the current Medicare contracts— 
based on non-compliance of Medicare contractors. 

• Another concern with the proposed contract amendment is that we believe 
HCFA has current authority to terminate contractors that do not meet its perform- 
ance standards, including Year 2000 compliance. 

Notwithstanding these concerns, we are willing to sign an amendment if the 
terms are appropriate. 

Two weeks ago, HCFA responded to our letter. It acknowledged that it was not 
the agency's intention to require compliance with contractors outside of the contrac- 
tors' direct control. We are now working with HCFA to redraft a new amendment 
that is mutually agreeable. 

In addition to our work with HCFA on the contractor amendment, we are collabo- 
rating closely with the agency on compliance issues. BCBSA has, in fact, rec- 
ommended a regular, formal process to assure regular communication with HCFA. 
A steering committee to facilitate this communication has been established. The 
steering committee which is chaired by HCFA's chief operating officer and vice- 
chaired by BCBSA— has established four working groups and will hold its third 
meeting on J une 2. We are very pleased with the progress that has been made at 
these meetings and with the constructive dialogue between HCFA and the contrac- 
tors. We look forward to more of this type of cooperation. 
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Ml. Other Factors Affecting Contractor Compliance 

In reviewing the circumstances and issues reiated to Year 2000 compiiance, the 
subcommittee shouid be aware of two additionai issues that have made Year 2000 
compiiance activities even more chaiienging. 

First, there has been a significant change in direction in how contractors are to 
proceed in assuring miiienium compiiance. Originaiiy, many of the system changes 
that are necessary for compiiance wouid have been accompiished by the conversion 
of aii Medicare contractors to the Medicare Transaction System (MTS). As you 
know, the MTS initiative was dropped iast year. As a resuit, contractors had to 
make significant changes that, in the absence of MTS, they wouid have been work- 
ing on for some time. 

In addition, instead of converting to the MTS system. Medicare contractors are 
now transitioning to a singie Part A and Part B system. In some cases, this conver- 
sion to different systems has made it more difficuit to focus on miiienium compii- 
ance. As a resuit, severai contractors requested that FICFA deiay transition require- 
ments so they couid focus on Year 2000 issues. We are very pieased that just iast 
week, FICFA agreed to delay transitions for some Plans. We are continuing to work 
with FICFA to assure priority attention to this effort. 

The second issue is funding. We anticipate Year 2000 compliance to be very costly, 
but funding has not yet been available to contractors to cover their expenses. As 
a result, contractors have had to reallocate funding from other important activities 
on a temporary basis. 

Some of the costs that contractors will face include: 

• Additional salaries and benefits for FTEs; 

• Additional software licensing, telecommunications, and a CPU upgrade: 

• Testing of software programs: 

• Testing and upgrading telephone and security systems: 

• Testing of LAN and PC environments: and 

• Training costs, including provider training. 

We are very pleased that Congress included in the FY 1998 supplemental appro- 
priation bill reprogramming of $20 million to cover miiienium costs. But given the 
high costs of compliance, we believe more funding is necessary. 

Compliance will be both time- and resource-intensive. For example, contractors 
will need to properly test new computer systems, which necessitates that they model 
their systems in a closed environment. Contractors will have to use separate staff 
and software and construct separate systems to do proper testing. 

IV. Contractor Reform Is Not Necessary 

I n addition to pursuing amendments to the contracts, FICFA is also seeking legis- 
lative authority to dramatically restructure the Medicare contracting process. This 
effort to make broad changes in contract authority is not a new initiative. But most 
recently, FICFA has been arguing that this contractor reform is necessary to assure 
compliance. 

Given our efforts to work cooperatively with FICFA on this issue and the broad 
authority FICFA already has under current contracts, we are disappointed and per- 
plexed about why it is linking contractor reform legislation with Year 2000 compli- 
ance. 

Contractor reform would not improve the Year 2000 problem. Every potential new 
contractor would face the same difficulties as current contractors, such as govern- 
ment compliance dates that are later than the compliance date for Medicare contrac- 
tors. In fact, contractors unfamiliar with the Medicare program would have the 
added burden of having to learn its extremely complex rules and regulations while 
simultaneously working to achieving miiienium compliance. 

Under contractor reform, FICFA would potentially have to manage many new con- 
tracts for cl ai ms-processing services with entities unfamiliar with Medicare. Man- 
agement of these new contracts would require diversion of major FICFA resources 
at a time when FICFA has many other responsibilities such as implementation of 
the Balanced Budget Act and the Flealth Insurance Portability and Accountability 
Act. Also, FICFA has just begun to implement the new contracting provisions for the 
Medicare Integrity Program. We believe the agency does not have the resources or 
staff to implement any additional procurement activities. 

Importantly, FICFA already has broad authority to sanction contractors that are 
not in compliance. FICFA can replace or terminate contractors for poor performance, 
including non-compliance for Year 2000. In fact, in a letter sent to contractors on 
November 17, 1997, FICFA indicated that "failure on the part of a [Medicare] con- 
tractor to bring its system into compliance will be considered a serous deficiency in 
contract performance." Contractor reform— or even a contract amendment— is not 
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necessary to replace contractors that are not millenium compliant. The contract 
amendment would only provide HCFA with more detailed performance criteria. 

For several years, FICFA has been seeking contractor reform legislation that 
would give FICFA broad authority to fragment the functions of current contractors. 
We believe that contractor reform provisions: jeopardize the continuity of Medicare 
claims payment to providers and service to beneficiaries: are ill-advised in the ab- 
sence of FICFA articulating a new strategy for Medicare administration and of pub- 
lic debate on that strategy: are unnecessary for the continued smooth operation of 
the Medicare program: and give FICFA extraordinary authority not needed in the 
current environment. 

This proposal would have significant implications and unintended consequences 
for Medicare beneficiaries and providers. The Ways and Means Subcommittee on 
Flealth has reviewed and rejected similar proposals in the past. 

Our specific concerns with the contractor legislation are as follows: 

• Current law gives the Flealth and Fluman Services Secretary authority to termi- 
nate Medicare contracts for lack of performance. Beneficiaries and providers have 
been well served by this language. The so called "reform" legislation would give the 
Secretary and FICFA a free hand to terminate contracts at will, regardless of how 
efficiently and effectively the contractor has performed under the contract. Medicare 
contractors’ provider payments and services to beneficiaries thus would become sub- 
ject to the whim of FICFA staff. 

• The "reform" legislation also would authorize the transfer of functions among 
fiscal intermediaries without regard to any provision of law requiring competition. 
Transfer of functions could happen at the whim of FICFA, with no warning and no 
recourse for the contractor or providers effected by the transfer. This would create 
an unstable system and would prohibit contractors from investing in the technology 
and resources needed in top-flight organizations. 

• As noted, this legislation would provide FICFA with expanded, unprecedented 
authority to terminate and debar contractors without due process or appeal rights. 
Like the Year 2000 contract amendment, this language could be interpreted as pre- 
cluding any terminated contractor from receiving other government contracts, such 
as FEP, CFIAMPUS, Medicaid, and Medicare-fChoice. The lack of due process and 
the de facto debarment provides FICFA with authority well beyond what is allowed 
by the Federal Acquisition Regulations (FAR). 

This reform proposal would give FICFA the authority to totally revamp participa- 
tion in Medicare contracting within one year of enactment without due process for 
current contractors and without competition. Taken together these reform provisions 
would give FICFA the authority to cast out with no recourse Medicare contractors 
that have served the country faithfully for over 30 years, without stating the plan 
for future Medicare contractor administration. What will it look like? Who will 
FICFA contract with? What experience will they have? Flow will service to bene- 
ficiaries and providers improve? This authority and the possibility of an unplanned, 
behind-closed-doors use of it would impede Medicare contracting for many years to 
come. 

Success in Medicare claims administration requires that FICFA and the contrac- 
tors work together toward their mutual goal of accurate and timely claims payment. 
This partnership should extend to planning the future of Medicare contract adminis- 
tration. 

Change in Medicare contracting is ongoing and inevitable. In the last ten years, 
the number of contractors has declined, with most withdrawing from Medicare con- 
tract administration to pursue private business interests. MTS failed, but FICFA is 
rapidly moving the contractors onto three standard claims processing systems that 
FICFA controls. This represents a dramatic opportunity for the government to di- 
rectly control program expenditures and reduce the variability that exists through- 
out the country. 

In summary, we do not believe these legislative changes are necessary to assure 
efficiency and high performance levels. 

V. Conclusion 

Let me reiterate that Medicare contractors are working diligently to become 
millenium compliant by December 31, 1998. This is a monumental task, and we will 
face a number of challenges along the way. Medicare contractors are committed to 
meeting these challenges just as they have done in the past. 

We will continue to work with FICFA to resolve issues that arise and to ensure 
compliance. A cooperative approach between contractors and FICFA will achieve the 
best results. 
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Congress should r^ect HCFA's use of year 2000 compliance as a reason for legis- 
lating far-reaching changes to the Medicare contractor program. Contractor reform 
raises fundamental issues and implications for the Medicare program. In fact, con- 
tractor reform could introduce change, confusion and diversion of resources at a 
time when experience and focus is important. 

Thank you for the opportunity to speak with you on this important issue. 


Mr. PoRTMAN. Thank you, Ms. Lehnhard. And we're now joined 
by the Chairwoman of the panel. 

Chairman J ohnson of Connecticut [presiding]. My apologies for 
having to have been absent much longer than I thought I would 
have to. But I'm going to let Mr. Portman start questioning, and 
then join in. 

Mr. Portman. Well, first thanks to all the witnesses. I 've learned 
a lot and although it seems as though the panel is somewhat empty 
this afternoon, know that the staff is here and, after all, they're the 
most important people around. But more important, honestly, your 
written remarks are in the record. That record is reviewed and that 
is the basis upon which we often act so it's very important you're 
here today to bring more, frankly, public and congressional atten- 
tion to this very critical issue. 

I learned a lot about the private sector today because I've been 
more focused, of course, on the Federal agencies, particularly the 
IRS and also the interconnection of not only the Federal agencies 
to the private sector, particularly in some of these more regulated 
areas, like hospitals and insurance, but also with regard to the 
interconnection between companies. So if a bank, for instance, 
spends 3 years getting all of its year 2000 problems resolved it 
really doesn't matter because you still have to deal with the Fed- 
eral Reserve and other banks and other institutions. 

And, finally, Mr. Bace started off by shocking us with his analy- 
sis and I guess what I've learned is about the international aspect 
of this. That there's not just a national problem. Mr. Bace, in look- 
ing at your chart, which you didn't have time to go into in your oral 
remarks, but those who haven't seen it, you want to get a copy of 
this because it's very interesting to see the degree to which the 
United States is actually somewhat ahead of other global trading 
partners where we have this interconnected relationship. 

I guess I would start off by saying I'm impressed enough today 
to understand that the message is important. And you talked about 
Apollo 13, Ms. Dec, and Lovell saying, "Flouston, we have a prob- 
lem." I go back to the well of the Flouse of Representatives where 
j ack Kennedy said we're going to get to the moon, and that's 
maybe even the better analogy here because we need that kind of 
leadership and maybe that kind of consolidation of effort on the 
FI ill and downtown, meaning at the White Flouse. So I hope that 
President Clinton and Vice President Gore, being as interested as 
they are in information technology and the hope for information 
technology to even spur further economic growth, will also start to 
focus more on this very real problem in our information technology 
revolution, and begin to take more of a leadership role as well as 
Congress. Frankly, they have a bully pulpit that is somewhat more 
powerful than ours. So although we need to do more, as Mr. Miller 
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said, I think we also have to try to encourage the administration 
to do more on a national level with the private sector. 

My first question for Mr. Bace and any of the panelists is from 
what you heard from that first panel, do you think our Federal offi- 
cials understand the risks, that they understand the challenges, 
and do you think they are taking adequate steps to manage and 
mitigate those risks? 

Mr. Bace. Yes, I do. I believe that they are very much aware of 
the issues facing them, but I think there has generally been, for a 
lack of a better term, sort of management malaise for years think- 
ing that it's just a simple information technology problem, an IT 
problem. Go fix the two digits dates in the computer and, as Mr. 
Miller was saying, there's a serious lack of a crisis attitude within 
society. I had hoped we would have been getting these kind of sta- 
tus reports maybe 2 years ago where we still had much more time 
instead of being within 603 days of the millennium crossover at 
this point in time. 

Mr. PoRTMAN. Mr. Miller. 

Mr. Miller. Mr. Portman, I think they're also hamstrung by the 
lack of financial resources. The current numbers we're hearing for 
the government is $4.7 billion. This sounds like a lot of money, but 
then you realize that one company. General Motors or Citibank, is 
talking about spending $600 million alone. That government num- 
ber is ludicrously small. Obviously, again, as government officials 
they have to stay within the party line. And the party line from 
the Office of Management and Budget is we don't need more 
money. But, clearly, if you listen to them carefully, they do need 
a lot more money and additionally they have the problem of the re- 
tention of employees which is very serious. I chaired a panel re- 
cently of senior human resource people from the government and 
they indicated there are very serious retention problems. The Office 
of Personnel Management is trying to be helpful. But the fact is 
salaries are going up so rapidly in the private sector that it's very 
hard to convince people to stay in the public sector. So money is 
a huge problem and that's why we're recommending, at a mini- 
mum, Congress provide some contingency funding and somehow 
work out a way to get the Congress to give additional funding be- 
cause there has to be more honesty about the needs for funding. 

Mr. Portman. J ust one quick comment to that, I think we have 
to rely to a certain extent on 0MB to tell us what the funding 
needs are. I mean, it's difficult for us, on this Subcommittee or 
Committees, to establish what the priorities are and to spend even 
that $500 million which, as you say, is a somewhat questionable 
sum given that General Motors, as you indicated, said they're going 
to spend that amount as one company, a relatively large company. 
But, so, I think you're right but, again, I would turn some attention 
back downtown to say they have to tell us, I mean, they're the ones 
that know where those needs are within their agencies and how to 
allocate those funds and prioritize those funds. And we gave the 
Commissioner opportunity today to talk about that, and he said he 
had adequate funding in this fiscal year. He indicates for next fis- 
cal year, they'll need more. But when pressed, he seems to be say- 
ing it's not a resource question. But I appreciate your input. You've 
talked to people maybe in a more candid environment without 



96 


0MB there. Other comments on the Federal witnesses this morn- 
ing? 

Ms. Lehnhard. 

Ms. Lehnhard. Mr. Portman, I would also suggest that a strong 
signal from the Congress to the executive branch to focus on this 
as a priority and eliminate, I believe the panelists mentioned that, 
other activities that pull resources away. I can't overemphasize 
that. And I would also suggest that this is probably not the time 
to be passing major legislative proposals that are again going to di- 
vert HCFA resources. They're still struggling to implement FIIPAA 
and BBA, and to put a major new legislative proposal on the top 
of that at the time we're struggling with year 2000 compliance, it 
is just not a timely— an appropriate time to do that, we believe. 

Mr. Portman. That is a point well taken and Mrs. j ohnson is on 
the Flealth Subcommittee and is closer to these issues than I am, 
but I think what we heard from the Commissioner today is consist- 
ent with that which is we need to be careful not to overburden the 
system in the next 18 months, otherwise we will not be able to 
meet both the legislative priorities and the year 2000. I would also 
harken back to what Mr. Miller said earlier about legislation. If 
you have specific ideas on the R and D tax credit, for instance, or 
tax deductions, or other tax preferences that might be helpful to 
move this effort forward in the private sector, I hope you're letting 
us know with more specificity. Maybe it's in your written com- 
ments. 

It's difficult for us, given the timeframe here, we're sort of like 
the companies in the middle of the year 2000 crisis, we need more 
time because we're probably going to have only one shot at it, 
which will be the tax bill which will be put together in the next 
few months in order to be able to affect what happens in turn be- 
tween now and the year 2000. 

So to the extent you have thoughts on FICFA in addition to what 
you've indicated administratively, if you think there's something 
legislative we should do, for instance, you need to get that to us. 

And I guess I'll give the opportunity, Ms. j ackson, to discuss 
that, and then I will turn it over to the Chairwoman. 

Ms. j ACKSON. One of the other things that we found that I be- 
lieve members of this other panel have mentioned is how enormous 
this problem is and that it is not restricted to what I think every- 
one thought, and a lot of people still think that it's computers. And 
what we hear is that because we are so advanced in this day and 
age in computer technology, there's some sort of assumption that 
there's just going to be a fix, that someone will find the fix. And 
there's a growing recognition that it also has to do with how we 
move money and how we keep records. But there is a whole other 
side to this, and we're finding in our industry that it's operational. 
And, for instance, in health care, as we've discussed, it has to do 
with how we take care of patients, not just how we run the busi- 
ness end of it, but actually taking care of patients and I'm sure 
that's true in other industries as well. That there are very concrete, 
critical operational issues that are going to arise. 

Mr. Portman. With regard, again, to the medical devices issue 
you mentioned, which I guess would fall in that category, if you can 
give us more specificity as to what we should do legislatively vis- 
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a-vis the FDA, that would be very helpful, that's not within this 
Committee's jurisdiction, as you know, but we do get into Medicare. 
[Laughter.] 

And that's the sort of thing that, again, if we don't begin that 
process of legislating now, it will be too late to be able to affect this 
particular problem. I know FDA can do a lot administratively but 
if you could give us some more guidance on that, that would be 
helpful. 

Ms. J ACKSON. And we very much appreciate that opportunity but 
would note that, in terms of the FDA, there is strong legislative 
and perhaps regulatory authority that already exists and a very 
clear congressional policy as to how that should be applied in part- 
nership with all of us. 

Mr. PoRTMAN. All right, well, again, I really appreciate the pan- 
el's input and I'll turn it back to the Chairwoman who was here 
all morning listening to the government witnesses. And I thank 
you for your testimony. 

Chairman Johnson of Connecticut. Thank you very much for 
joining us. j ust to follow up on the issue of all the things we're not 
looking at, I appreciate your suggestion, Ms. j ackson, that we use 
existing authority, but we would need a lot of help from the private 
sector and the public sector to sort of shape what is that mandate 
that we're putting out there because we really are, I would say, you 
know, only in the last few months developing any depth of knowl- 
edge ourselves of even what the challenge is to our own executive 
branch in management and interrelationships, and public, private 
impacts, as opposed to just technology, and programs, and comput- 
ers, so this issue that you bring up is extremely important and the 
more I've read in this area, the more I understand how important 
it is. I have literally no way of, in a sense, laying out in verbiage 
all of the scope of that directive that we clearly ne^ to put in place 
so that we, in a sense, permeate the information system in the pri- 
vate sector and make it work faster. 

I'm not at all sure that this doesn't take legislation, some kind 
of mandate that any company that makes anything at all with a 
timing chip in it has to reveal that and publicize the fact that this 
is a problem and when they plan to fix it. I think probably there 
is no one who can define all of the ways in which this issue is going 
to insinuate itself in our lives and so I think some umbrella action 
like that, and if any of you have thoughts on how to develop that, 
we would be very interested in having you work with us. 

Mr. Miller. One possibility. Madam Chair, following Mr. 
Portman's suggestion, is to ask the Congressional Budget Office to 
assume Mr. Yardeni is right in terms of the impact on the GDP, 
and determine what does that mean in terms of the Federal and 
State tax collections over the next 2 to 3 years. Maybe that would 
get 0MB 's attention. 

One accountant did an analysis just in the State of New j ersey, 
and he estimated it could cost the State of New j ersey several hun- 
dred million dollars in lost anticipated tax revenue. That's just one 
State. Fie did not do a national sample. So we're back to this Ka- 
buki dance I referred to earlier. It's tough to get the administration 
to admit that it needs more money because the mantra downtown 
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is, Let's stay within the balanced budget agreement, let's not go 
outside of it. 

But if the tradeoff for that, as I suggest in my testimony, is down 
the road a recession, as Mr. Yardeni and others are suggesting, and 
a loss of economic activity and a concomitant loss of revenue to the 
Federal Government, then all the great plans this Congress has 
carried out to get us back to surplus can quickly be reversed. 
Maybe the way to get OMB's attention is to have the Congressional 
Budget Office do that type of scenario: Not to predict a recession, 
but just to say what the outcome could be. Then 0MB would real- 
ize that you've got to fix the roof now to make sure you don't have 
serious leaks down the road a couple of years. 

Chairman Johnson of Connecticut. Yes, I appreciate that. I'm 
not, I think it's, it's not likely, in my estimation, and I may be 
wrong, and I'll be interested in GAO's evaluation of this, in my es- 
timation it's not likely that they really can see and understand big 
costs that they're not telling us about. I think they believe their es- 
timates. They may believe that they are skinny. They may believe 
that they're on the conservative side, but I don't believe that their 
understanding of the problem leads them to believe that they need 
three times as much money but they don't have the nerve to say 

it. 

So there are just too many back channels, there's too many, 
we've had too many hearings. We've got people like Steve Horn out 
there who has worked on both sides of the administration. It is con- 
ceivable to me that some of you who work in this area more broad- 
ly, in a sense, and look at its ramifications and have seen big bu- 
reaucracies move further along in the accommodation than we 
have, would have a different view. 

But, for instance, you know, the Social Security system is really 
well along. I think that at this point there's a level of knowledge 
that we haven't, in a sense, forced out on to the table about what 
compliance is going to involve, at least that's just what I hear you 
saying and what I, you know, what you say reverberates in my 
mind with some of the things I 've read. But, you know, to what ex- 
tent do you think that's the problem? 

Mr. Miller. Well, again, you don't have witnesses up here pro- 
tected by cloth covering 

Chairman j ohnson of Connecticut. Right. 

Mr. Miller [continuing]. Like you did on the IRS whistle blower 
hearing. I spoke recently before a group of Army officials at the in- 
vitation of the Army Science Board. I will tell you the official Army 
line of the people who spoke, the generals and the civilians, was 
"We're going to tackle this, we don't need any more money." I got 
up and said, "I'm skeptical of that based on what my contractor 
members and other people like Gartner say." The coffee break 
came, and sure enough, those same people who stood up in front 
of the room and said, "We're going do this and we're going to get 
it done with the money we have"— and these are can-do people of 
the military— privately said there's no way we can get this done 
with the resources we have. And you hear that over and over 
again. When you drill down a little bit, that's what you get. It 
seems to be the relationship, as one of my members suggested, be- 
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tween how high in the organization you ask the question and how 
favorable a response you get. 

Mr. Rossotti, if you really listen to him carefully, I think was 
saying, "Help." Now, maybe he is constrained by 0MB not to ask 
for more money but I think if you listen to him carefully, he has 
problems. He has very senior management positions unfilfi^ today. 
He has no CIO, for example. 

Chairman Johnson of Connecticut. Well, I think the personnel 
issue is a very significant issue but, you know, I think you need 
to help us frame better questions if we're going to elicit the right 
answers. 

Mr. Miller. OK. 

Ms. Dec. I just wanted to add something of this morning where 
we heard a lot about every organization giving this a high priority 
and executive commitment. I think the thing we have to be careful 
of is that I'm sure the sincerity is there and they all believe in it, 
but the difference is to be able to make that happen. And the sta- 
tus of today's projects shows real indication that only 50 percent 
of it is going to be done. So just hearing the words isn't the answer. 
It's the ability of the government to change those business prior- 
ities and measure the effect new bills will have on the computer 
system and on the year 2000 work. And it's almost as if you need 
to, in each of the organizations, is set up a task force who will 
make the decision on what work is going to get done and what is 
mandatory, other than the year 2K work? Because what happens 
is by the time it drifts down, honestly, if you did an outside review, 
you'd probably see over 50 percent of the work is non-Y2K work. 
You have to understand that simply saying the words is not going 
to provide the actions. And, again, having been at Prudential 3 
years 

Chairman Johnson of Connecticut. I do understand that but I 
think you're going to have to help us define much more accurate 
questions if you're going to expect us to understand what you're 
talking about, you know. The agencies come up and they say how 
many systems have, and how much equipment, and presumably 
they do know what they mean when they say that, and it's not 
hard to evaluate the cost of equipment replacement. And there's a 
lot of very old equipment in the Federal Government, and a lot of 
it's going to have to be replaced. And then there are system 
changes, some of which are hard and some of which are easy, I 
wonder what your evaluation is, Mr. Bace and Mr. Miller? And I'm 
sorry I didn't get through all the testimony, but anyone who would 
really like to comment. 

One of the problems that we're running into, particularly in the 
IRS, but this is also true in HCFA, both of which systems have had 
really failing efforts of technology modernization, so we have par- 
ticularly old systems and multiplicity of disparate systems, and so 
we almost have to modernize the systems and deal with the main- 
frame problem at the same time we're doing this. Now, that's my 
conclusion. Do you think we have to take on things like mainframe 
consolidation at the same time we're taking on Y2K? 

Mr. Bace. I think what you have to be aware of or look at in 
total here is that year 2000 is not a technology problem. It is a 
business problem and a management problem that is infested due 
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to some technology anomalies that occurred some years back. From 
what I heard this morning in the panel is that, given the things 
that I study for the Gartner Group which include the dynamics of 
this very immature marketplace, the year 2000 marketplace, and 
by the way, this may be the first marketplace that never reaches 
maturity. The clock will run out before it ever grows up. So it's a 
very unusual market but what I heard this morning, there was a 
cognitive dissonance there. I heard people talking about high turn- 
over rates, losing employees, which is true across the entire indus- 
try within the traditional and user enterprise, the turnover rates 
are 12 to 15 percent. In the service provider category, they are 18 
to 20 percent. We have some reports as high as 70 percent turnover 
of staff. 

Chairman J ohnson of Connecticut. You mean in the private sec- 
tor? 

Mr. Bace. In the private sector, yes, of turnover of employees. I 
think it was Mr. Rossotti who said that, you know, he had an 8- 
percent turnover rate. I thought, my God, that's great. And part of 
what is fueling that is the inflationary costs. If you're talking about 
contractors coming in to do services work in the IT industry right 
now, in 1997, my research found that there was a 20-percent infla- 
tionary cost and if we plotted that out, we're looking at about a 50- 
percent increase in contractor and external service providers for 
Y2K work between now and the year 2000. So if the cost of your 
basic raw materials and the people who are going to come in and 
help you is going up by an inflation rate of 50 percent, you're going 
to neki, perhaps, some more money. And that's just based upon 
what was said. 

Chairman J ohnson of Connecticut. Yes, I think that's very like- 
ly. I mean, I think that's logical and you can anticipate that that's 
going to happen. What do you think about that same kind of mech- 
anism on the production end? I mean here we already have the 
Federal Government saying they're not getting the components. 
Well, if you don't get the components, you can't do the testing. If 
you don't do the testing, you know, beginning a year out, you're not 
going to have a good system. I had a small banker tell me, over 
a year ago, that he already ordered all his new computers and it 
was only going to cost him $400,000. This is a relatively small 
bank. It only has several branches, and yet it cost him $400,000. 
And he just did it early because he wasn't going to be caught. 

And I wonder how many haven't done anything. I mean what is 
going to be the demand, the production demand on the computer 
industry? I mention this to some computer, you know, some 
businesspeople in that area and they said the industry is at such 
undercapacity right now, it's a good time for this to hit. Are there 
ways we should be focusing the purchasing process of the Federal 
Government, making sure that that, beginning now, is going to roll 
out in a way where the demand can be met? What is the aspect 
of the problem? 

Mr. Miller. The purchasing process does have some reforms. 
The government has taken advantage of some of the provisions 
that Congress implemented in 1996 to allow that. But we have sug- 
gested some other reforms and we would be glad to share that with 
you in detail. But I'd also like to emphasize the work force issue. 
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Our study recently identified 346,000 vacant positions in the pri- 
vate sector today. Salaries going up in double-digit rates. I found 
out at the work force panel that I chaired recently for the Reinven- 
tion Revolution Conference that the Vice President ran is that the 
workers who are staying in the Federal Government are older. And 
that's not to say older workers aren't also productive. But they're 
getting close to retirement, so they're staying in. But the Treasury 
Department, for example, said that 70 percent of their work force 
in IT will be eligible for retirement in the year 2004. They're hav- 
ing a very hard time recruiting new people, younger people, be- 
cause they're able to pay GS-5 salaries in a marketplace which is 
demanding GS-9 or GS-10 salaries. 

And the other place they're having difficulty is where Mr. 
Rossotti is having difficulty— finding CIOs and senior managers be- 
cause the CIO salary, $125,000 or whatever it is in the govern- 
ment, compared to $300,000 in the private sector— is very, very dif- 
ficult to do. Mr. Rossotti, I believe, has gotten a waiver to raise 
that a little bit, but that's very difficult. So I would really empha- 
size the work force side of it. Madam Chair. I think that's really 
a big difficulty. 

We have suggested some changes in procurement. The Federal 
Government has been relatively flexible in that area, surprisingly 
so in a positive way. 

Ms. Lehnhard. I would point out one example where, I think, 
the executive branch has focused in this discussion about doing 
only what's necessary. I mentioned a week or two ago, FICFA said 
they're going to drop some transitions to a single system for part 
A and part B in Medicare and that allowed us to free up more peo- 
ple to focus on year 2000 compliance. I think that's the type of very 
positive exchange and working out of priorities that needs to go on. 
The other thing I would mention again that has our plans very, 
very concerned on the private side and their government side is an- 
other massive piece of legislation. 

As I mentioned, we're still implementing FIIPAA and BBA. I 
would give you one example. One private side change was mental 
health parity, a relatively simple provision. FICFA is so overloaded 
with responsibilities right now that even though they move very 
quickly, they weren't able to get the regulations out on that until 
December 28 which meant that we couldn't sign our private side 
contracts until December 28 or J anuary 1, then we had to make 
all our systems changes once we knew what would be legal within 
2 or 3 days. And some plans had to process by hand because it 
takes a long time to make these system changes. That was one lit- 
tle provision. 

The bills that are being contemplated now have hundreds of pro- 
visions like that, particularly if you get into quality measurement, 
outcomes measurement, and data collection. Those are going to be 
hundreds and hundreds of systems changes at the same time we're 
trying to do compliance on both sides and it will affect both our pri- 
vate side business and Medicare. 

Chairman J ohnson of Connecticut. Thank you. That was very 
interesting, very helpful. 

Ms. J ackson. 
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Ms. J ACKsoN. One of the other issues, as we've talked a lot about 
all the work that we have to do, is our reliance on systems and 
products that are not within our control; and our need to have in- 
formation on medical devices is a primary example. And that's why 
I was particularly pleased to hear your interest in creating an at- 
mosphere where mandatory disclosure or full disclosure is manda- 
tory conduct. We don't know why we're not able to get some of the 
information. We think it may be because it's not available yet, that 
manufacturers of products haven't completed their testing. But we 
also have a concern that there's a fear of liability and that's why 
some of the manufacturers have not released their information. So, 
again, an atmosphere of full disclosure of information and commu- 
nicating and sharing of information is very important for us all to 
work in partnership to address this issue. 

Ms. Lehnhard. You know, one thing I would say, I think you 
have to make it a sexy issue. Right now it's a wonk issue and I 
think you have to make it OK to talk about how these bills, these 
activities, are a problem administratively. Right now, that's an in- 
side the beltway issue. It's not an issue that's acceptable to the 
American public to say you can't do certain things because of that. 

I don't know if we can get there but that 

Chairman Johnson of Connecticut. It's very hard to make a 
management issue a sexy issue and the danger is that you make 
it sexy by sort of picturing doomsday. And one of the little vi- 
gnettes I read was the tip of the coolants in the radar system at 
the airport is time dependent. And it could stop releasing the cool- 
ant once we roll into the year 2000. The radar will go out and the 
airports will close. So, I mean, that helped me a lot to see, and I'll 
tell you I hear what you're saying differently because I read that 
example because I really hadn't thought about this issue of its in- 
sinuation into so many situations, and I think it's not just the 
health equipment producers. It's really any manufacturer who pro- 
duces anything that has a chip in it that triggers any action on the 
basis of date. And how you get a grasp of how to get that level of 
public disclosure out, I don't know but certainly I hope you'll think 
about it and get back to us with some ideas because I can see how 
important that is. 

Mr. McManus. Before we close, if I could suggest that you were 
looking for questions that you might ask, going forward, of people 
that come to you and present numbers or plans to you. The first 
question that should be asked is, "What's included?" "What have 
you included in the scope of this project in this dollar amount, what 
is included in that?" The second question is, "What's excluded?" 
And then the third question, "Who controls what's critical and 
what's the definition of critical?" Because if people are redefining, 
"Well, this was critical but it's not critical any more because we're 
too close to the deadline." Then the inventory shifts on you and the 
inventory needs to include a lot of other things besides desktops 
and mainframes and telecommunication systems. 

I mean, there's a lot of third-party vendors that are going to help 
any agency or business get through the day and does this dollar 
figure that you're prepared to spend, or saying that that's enough 
resources, that's enough money for my agency, does that include all 
these third— some analysis of all of these third-party vendors? And 
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it will quickly get you into a level of detail if you're trying to put 
the puzzle together. If there's a piece missing there's an expla- 
nation for what's not a part of that puzzle. 

Chairman Johnson of Connecticut. Thank you very much for 
your testimony, and I look forward to reading the parts that I 
hadn't had a chance to read. And I really appreciate your thought- 
fulness and your experience, and I invite your continued input as 
we move forward with this. And we will share your thoughts with 
Steve Horn and his Subcommittee too and see if we can't get a lit- 
tle broader systemic response. One of the things that's hard for the 
Congress is that the oversight is Committee by Committee. And so 
while Ways and Means has oversight over a lot of the systems, we 
don't have oversight over all the systems and I don't know that 
anybody knows exactly what's going on everywhere but there are 
certain common threads and common problems and I very much 
appreciate your working with us. 

Thank you. 

The next panel will be Lynda Willis from the GAO, Joel 
Willemssen, Director of Civil Agencies Information Systems, Ac- 
counting and Information Management; accompanied by Randy 
Hite, Senior Assistant Director of the Defense and Government- 
wide Systems, Accounting and Information Management Division. 

Welcome, welcome, Lynda, thank you for being with us today and 
I always hate to have you sit through the whole hearing. It is use- 
ful to us to have you hear all the testimony that went before and 
I look forward to your comments. 

STATEMENT OF LYNDA D. WILLIS, DIRECTOR, TAX POLICY 

AND ADMINISTRATION ISSUES, GENERAL GOVERNMENT 

DIVISION, U.S. GENERAL ACCOUNTING OFFICE 

Ms. Willis. Thank you. Madam Chairman, I can assure you it 
was very useful to us to sit there and hear not only the other pan- 
elists, in addition to the Commissioner, whom we have a lot of con- 
tact with on this issue, but also the private sector who reflect some 
of the very concerns that we have as well. And I think, while not 
wanting to be alarmist about it, that there is no question that 
there are major issues here that need to be address^ and, most 
important of all, time is running out and that is our most impor- 
tant resource right now and it is something that you cannot buy. 
And I think that that's one of the problems that they're having in 
getting a handle on this. 

IRS, for example, has less than 9 months to complete the work 
that it believes is necessary to reach its goal of having all of its sys- 
tems year 2000 compliant by the end of J anuary 1999. Meeting this 
goal is important to help ensure that IRS has almost a full year 
and a filing season to test the multitude of changes that are nec- 
essary and to fix problems that will undoubtedly arise. 

Madam Chairman, we identified two significant risk areas to 
IRS' year 2000 efforts. The first is the lack of a master conversion 
and replacement schedule. The second is a limited approach to con- 
tingency planning. As the Commissioner noted, IRS is taking ac- 
tions to address both of these concerns. A master conversion and 
replacement schedule could establish the sequential relationships 
between the tasks associated with the year 2000 conversion and re- 
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placement projects at IRS, identify how much a task can slip with- 
out affecting other tasks, or the overall year 2000 effort, help deter- 
mine whether programming and testing resources are likely to be 
available when needed as time gets shorter, and provide a tool for 
prioritizing and assigning programming and testing resources that 
are essential in the most efficient manner. 

I RS currently has a contractor working on the development of an 
integrated schedule of its year 2000 related efforts, including mak- 
ing all of the necessary tax law changes for 1999. But time is run- 
ning out for completing such a schedule. Unless IRS obtains a 
sch^ule soon, its value as a management tool to help anticipate 
bottlenecks is diminished. We also remain concerned that IRS' ap- 
proach to contingency planning does not address the likelihood that 
system failures could occur once systems are implemented. How- 
ever, recent communication, in fact, communication that took place 
this week with I RS officials, indicates that the agency will take ad- 
ditional steps to establish contingency plans for its highest priority 
systems. 

And, Madam Chairman, I'd like to stress here that a contingency 
plan is not necessarily an alternative system, that there are other 
ways that may need to be considered in terms of back up for any 
problems that would occur with a particular system with the year 
2000 failure. And that might be changes in businesses processes. 
It could even include changes in legislative requirements. And I 
think that a holistic and an expansive approach to contingency 
planning at this point is very important to making sure that we 
understand what the options are and also understand what it's 
going to take including time, resources, and so forth, to implement 
the contingencies. 

In summary, IRS has established the goal to complete its year 
2000 work by J anuary 31 so that it will have converted and re- 
placed systems implemented for the 1999 filing season. By estab- 
lishing this goal, IRS built a safety net into its schedule to allow 
time to work out problems. However, given the conversion status 
of some of its infrastructure areas, IRS runs the risk of not com- 
pleting all of its work byj anuary 1999. 

I'll stop my prepared statement there. Madam Chairman, I ask 
that the entire statement be placed in the record, and will be 
happy to answer any questions you may ask. 

[The prepared statement follows:] 

statement of Lynda D. Willis, Director, Tax Policy and Administration 

Issues, General Government Division, U.S. General Accounting Office 

Madam Chairman and Members of the Subcommittee: 

We are pieased to be here today to discuss the resuits of our work to date on the 
Internai Revenue Service's (IRS) efforts to have its information systems function 
correctly when processing dates beyond December 31, 1999. These efforts are nec- 
essary because I RS' information systems, many of which are over 25 years old, were 
programmed to read two-digit date fields. Therefore, if unchanged, beginning J anu- 
ary 1, 2000, these systems would interpret 2000 as 1900, and thus would seriously 
je^ardize critical tax processing and collection operations. According to IRS, the 
failure to change two-digit date fields before 2000 could result in generating millions 
of erroneous tax notices, refunds and bills. IRS has less than 9 months to complete 
the work that it believes is necessary to reach its goal of having all of its systems 
Year 2000 compliant by J anuary 31, 1999. Meeting this goal is important to help 
ensure that IRS (1) can accurately process tax returns during the 1999 filing season 
and (2) has almost a full year to test the multitude of changes that are necessary 
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and make additional corrections so that its systems operate properly in the next 
millennium. 

Our statement today is based on the work we did to prepare a draft report on 
the status of IRS' Year 2000 efforts. Our draft report is currently at IRS for com- 
ment. In preparing that report, we interviewed officials from IRS' National Office, 
computing centers, service centers, regions, and district offices. We analyzed and 
compared IRS' planning, budget, and performance-monitoring documentation with 
our Year 2000 assessment guide^ as a part of a structured approach for reviewing 
I RS' conversion efforts. 

Our statement today includes the following points: 

—For its existing systems, IRS has made more progress in converting application 
software than converting its information systems infrastructure, which includes 
hardware, systems software, and telecommunications. Despite its progress on con- 
verting applications, IRS fell short of its goal to have the applications for 66 of the 
127 systems that it considers mission-critical converted byj anuary 1998. IRS is still 
assessing or in the early stages of converting its hardware and systems software for 
two of its three levels of computing operations— minicomputers/file servers and per- 
sonal computers. Of all the infrastructure areas, according to I RS' tracking systems, 
telecommunications is at the highest risk for not being completed by J anuary 31, 
1999. 

—In addition to converting systems, IRS is undertaking two major system re- 
placement projects as part of its Year 2000 efforts. Both of these projects have en- 
countered some schedule delays. 

—In a briefing to this Subcommittee in I anuary 1998, we identified two signifi- 
cant risk areas to I RS' Year 2000 efforts. The first was the lack of a master conver- 
sion and replacement schedule. The second was a limited approach to contingency 
planning. IRS is taking actions to address our concerns regarding the lack of a mas- 
ter conversion and replacement schedule. Flowever, we remain concerned that IRS' 
current approach to contingency planning does not address the likelihood that sys- 
tem failures could occur once systems are implemented. 

Status of Conversion and Replacement Efforts 

To assist agencies in their Year 2000 conversion efforts, we developed an assess- 
ment guide that includes a structured, step-by-step approach that agencies may use 
for reviewing and assessing their readiness to handle the Year 2000 problem. The 
assessment guide states that the Year 2000 conversion efforts should be managed 
as a single, large information systems project. The assessment guide describes in 
detail the five phases of a Year 2000 conversion process (i.e., awareness, assess- 
ment, renovation, validation, and implementation). Each of these phases represents 
a major Year 2000 program activity or s^ment. To successfully address the Year 
2000 problem, effective program and project management is required for all five 
phases. 

IRS' Chief Information Officer (CIO) established several parallel efforts to help 
ensure that I RS achieves Year 2000 compliance by J anuary 31, 1999. These efforts 
include creating the Century Date Change Project Office, which is responsible for 
coordinating the conversion of most existing information systems that can be made 
Year 2000 compliant as well as ensuring that all systems are converted in accord- 
ance with a 14-step conversion process. That process incorporates the five phases 
included in our assessment guide. Some of the steps involved in converting existing 
systems include (1) correcting millions of lines of application code; (2) upgrading 
thousands of hardware and systems software products for IRS' three levels of com- 
puting operations— mainframes, minicomputers/file servers, and personal comput- 
ers, (3) upgrading telecommunications networks: and (4) ensuring that external data 
exchanges are Year 2000 compliant. 

The other parallel Year 2000 efforts are two major system replacement projects— 
the replacement of the Distributed Input System (DIS) and the Remittance Process- 
ing System (RPS) with the Int^rated Submission and Remittance Processing 
(ISRP) system and the consolidation of the mainframe computer processing oper- 
ations at 10 service centers to 2 computing centers. IRS personnel use DIS to input 
taxpayer data and RPS to input remittance data. According to IRS, these two sys- 
tems are old, and it is not cost-beneficial to make them Year 2000 compliant. There- 
fore, IRS decided to replace DIS and RPS with ISRP. ISRP will be piloted in two 
phases at the Austin Service Center. The first phase is underway and the second 
phase is scheduled to begin J uly 31, 1998. Nationwide implementation is scheduled 
for J anuary 1999. 


1 Year 2000 Computing Crisis: An Assessment Guide (GAO/AI M D- 10.1.14, Sept. 1997). 
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As a part of its mainframe consoiidation effort, IRS is to (1) repiace and/or up- 
grade service center mainframe hardware, systems software, and the associated 
teiecommunications infrastructure: (2) repiace about 16,000 terminais that support 
frontiine customer service and compiiance operations: and (3) repiace the Commu- 
nication Repiacement System (CRS) that provides security functions for on-iine tax- 
payer account databases. Repiacements of the terminais and CRS are criticai to IRS' 
achieving Year 2000 compiiance. 

Conversion of Existing Systems 

According to IRS, before] anuary 1999, it needs to compiete 12 steps of its 14- 
step process for converting (1) the appiications for its existing systems: (2) tele- 
communications networks: and (3) systems software and/or hardware for 
mainframes, mi nicomputers/fiie servers, and personai computers. In addition, before 
J anuary 31, 1999, IRS needs to (1) make its systems for externai data exchanges 
Year 2000 compiiant: (2) repiace its data input and remittance processing systems 
and, at a minimum, the Year 2000 portions of its mainframe consoiidation program: 
and (3) modify appiication software to impiement tax iaw changes for the 1999 and 
2000 fiiing seasons. 

Much of IRS' initial Year 2000 efforts focused on the awareness and assessment 
phases for the applications for existing information systems controlled by the CIO .2 
In May 1997, IRS began assessing the date dependencies of applications for infor- 
mation systems that were controlled by either field offices or business functional 
areas (hereafter referred to as field/customer systems). As a result of the CIO and 
field/customer system assessments, as of March 31, 1998, IRS had identified 127 
mission-critical systems, including 7 telecommunications systems. 

IRS has made more progress in converting its applications than in converting its 
information systems infrastructure. Specifically, as of March 31, 1998, IRS reported 
that it had completed the first 12 steps of its 14-step conversion process for applica- 
tions for about 59 (46 percent) of its 127 mission-critical systems. I RS' goal is to con- 
vert the applications for the remaining 68 mission-critical systems by J anuary 31, 
1999. I RS officials said they believe they are on track for meeting that goal. 

IRS has completed its assessment of the hardware and systems software for its 
mainframe computers. Conversion efforts for other infrastructure areas— hardware 
and systems software for minicomputers/file servers and personal computers, tele- 
communications networks, and external data exchanges— are, for the most part, ei- 
ther in the assessment phase or the early stages of conversion. According to IRS, 
of these areas, telecommunications networks will likely present the most significant 
conversion challenge and may be at the highest risk for not being completed by J an- 
uary 31, 1999. 

According to IRS, the capability to exchange information, both voice and data, 
among various computer systems is the backbone of IRS' ability to perform all of 
its tax processing and customer service functions. IRS uses a telecommunications 
network that is supported through the Department of the Treasury and additional 
networks that are unique to IRS. As of March 10, 1998, IRS had an inventory of 
the components that are included in Treasury's network and was verifying a pre- 
liminary inventory of the components in the networks unique to IRS. A contractor 
is currently doing a risk assessment to help develop a conversion schedule so that 
the most important work will be scheduled first to minimize adverse impacts if IRS 
is unable to complete all of its telecommunications work byjanuary 31, 1999. 

System R epiacement E fforts 

The two major system replacement projects included in I RS' Year 2000 efforts are 
experiencing some schedule slippages. For example, certain software development 
for ISRP that was to be completed in April 1998 is now scheduled to be done in 
J une 1998. As a result, the time available for testing before the start of the second 
phase of the pilot has been reduced. ISRP officials do not believe this two-month 
delay will affect either the start of the second phase of the ISRP pilot or its nation- 
wide implementation. According to IRS officials, IRS has revised its mainframe con- 
solidation completion schedule because of field office concerns about the ambitious 
schedule and pending expanded business requirements. Under the revised schedule, 

I RS plans to delay the consolidation of data processing operations of five service cen- 
ters from 1998 until after J une 1999. IRS officials said they expect to complete the 
Year 2000 portions of mainframe consolidation (e.g., terminal replacement and CRS) 
by J anuary 31, 1999. Flowever, according to IRS' weekly status reports on main- 


^ClO-contrdled systems are generally large, mainframe-based tax processing systems. Field 
or business functional area systems are smaller, more specialized systems that use a variety 
of platforms. 
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frame consolidation, CRS has been experiencing some difficulties and is somewhat 
behind its original schedulefor system testing. 

IRS IS Taking Actions to Develop a Master Conversion and Replacement 

Schedule 

I n our J anuary briefing to your office, we identified two major risk areas for I RS' 
Year 2000 effort: (1) the lack of an integrated master conversion and replacement 
schedule and (2) a limited approach to contingency planning. IRS is taking action 
to have a contractor develop a master conversion and replacement schedule. A mas- 
ter conversion and replacement schedule, according to our Year 2000 assessment 
guide, should be a part of an agency's Year 2000 Program Plan. This schedule could 
be used to track the progress of concurrent and interdependent projects that must 
be ready for integrated systems testing at the end of J anuary 1999. This year, IRS 
has a host of activities that it must complete concurrently so that its systems will 
be able to function correctly in 2000. Managing the interdependencies of these ac- 
tivities is critical to help IRS ensure the timely completion of its Year 2000 effort. 

A master conversion and replacement schedule could (1) establish the sequential 
relationships between the tasks associated with the Year 2000 conversion and re- 
placement activities, (2) identify how much a task can slip without affecting other 
tasks or the overall Year 2000 effort, (3) help determine whether programming and 
testing resources are likely to be available when needed, and (4) provide a tool for 
prioritizing and assigning programming and testing resources that are essential to 
the success of all Year 2000 efforts in the most efficient manner. 

Recognizing that several major and complex projects, including application soft- 
ware changes that are needed to implement recent tax legislation, must be com- 
pleted before the 1999 filing season, in November 1997, the Commissioner of Inter- 
nal Revenue announced the establishment of an executive steering committee. This 
committee is to identify risks to the 1999 filing season and the entire Year 2000 
effort and take actions to mitigate those risks. As a part of this effort, I RS developed 
a Century Date Change Project Schedule for its Year 2000 activities. Although the 
project schedule identifies the tasks for major Year 2000 activities, their correspond- 
ing start and finish dates, and the primary organizations responsible for them, the 
schedule does not yet establish a link between related tasks or analyze how the tim- 
ing of the various tasks may affect resource availability. Until these actions are 
complete, IRS cannot project whether resources will be available when needed for 
concurrent tasks. Thus, IRS faces the risk that resources may not be available when 
needed. 

IRS currently has a contractor working on the development of an integrated 
schedule of its Year 2000-related efforts, including making all of the necessary tax 
law changes for 1999. If properly developed, this schedule should meet the intent 
of the master conversion and replacement schedule called for in our assessment 
guide. But time is running out for completing such a schedule. Unless IRS obtains 
this schedule soon, its value as a management tool to help anticipate bottlenecks 
is diminished. 

I RS' Contingency Planning Approach Poses Risk to Continuity of Operations 

Contingency planning was the second risk area we identified in our January 1998 
briefing. In part, due to concerns that the same resources that are doing Year 2000 
conversion work would be needed to do contingency planning, IRS officials decided 
to develop a contingency planning process that would minimize the number of con- 
tingency plans that would have to be developed. Accordingly, IRS' "Century Date 
Change Contingency Management Plan" calls for developing contingency plans only 
for those business functions or processes that are supported by application projects 
that are at risk of not being made Year 2000 compliant on schedule. 

The Century Date Change Project Office has established criteria to identify such 
projects. For these projects, IRS is to initiate a business function impact analysis. 
Once that analysis is complete, technical and business owners evaluate available al- 
ternatives, including using any existing contingency procedures, such as manual 
procedures, or using an alternative technological solution, such as commercial off- 
the-shelf software. IRS plans to use a similar approach for initiating contingency 
plans for business functions when the conversion of infrastructure areas such as 
systems software, external data exchanges, and telecommunications network compo- 
nents fall behind schedule. 

IRS' "Century Date Change Contingency Management Plan" does not address the 
likelihood that information systems that are converted on schedule may experience 
system failures. As a result, IRS will be ill-prepared to effectively manage all Year 
2000-induced system failures that could affect core business processes. IRS' contin- 
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gency management plan does not address the possibility that (1) IRS may have 
overlooked a date dependency during its assessment phase of applications or infra- 
structure areas or (2) even if system conversion and replacement efforts are com- 
pleted on time and fully tested, unexpected system failures may occur. 

Aspects of contingency planning are under way for IRS' replacement projects (i.e., 
ISRP and mainframe consolidation). For example, the ISRP project office has devel- 
oped a contingency plan that identifies (1) various risks to the ISRP pilot and na- 
tionwide implementation, (2) the probability of those risks, and (3) contingency op- 
tions for addressing those risks. Also, as part of a larger effort to enhance IRS' dis- 
aster recovery capabilities, I RS officials said they hope to finalize expanded disaster 
recovery requirements for service center data processing in May 1998 so that those 
requirements can be included in the mainframe consolidation project. 

Our exposure draft on business continuity and contingency planning states that 
agencies must start business continuity and contingency planning now to reduce the 
risk of Year 2000 business failures.^ Among other things, the exposure draft states 
that agencies need to do a business impact analysis to determine the effect of mis- 
sion-critical system failures on the viability of agency operations. This analysis is 
to include examining business priorities: dependencies: service levels: and, most im- 
portantly, the business process dependency on mission-critical information systems. 
According to our exposure draft, the business impact analysis triggers the develop- 
ment of contingency plans for each core business process, including any information 
system components that support that process. Contingency plans would also address 
the actions IRS may take, for example, to notify taxpayers in the event that Year 
2000 failures cause significant delays in processing tax returns and issuing refunds. 

I n summary, I RS established the goal to complete its Year 2000 work by J anuary 
31, 1999, so that it would have converted and replaced systems implemented for the 
1999 filing season. By establishing this goal, I RS built a safety net into its schedule 
to allow time to work out problems with converted and replaced systems before J an- 
uary 1, 2000. Flowever, given the conversion status of some of its infrastructure 
areas, IRS runs the risk of not completing all of its work by thej anuary 31, 1999, 
milestone. Moreover, even if all of IRS' work is completed according to schedule, the 
potential exists for failures in systems that were fully assessed, converted, tested 
and implemented according to schedule. We remain concerned about IRS' narrow 
approach to contingency planning which focuses on developing contingency plans 
only for business functions that are supported by information systems projects that 
have a known risk of not being completed according to schedule. Under this ap- 
proach, IRS has no assurance that its core business processes will be able to con- 
tinue to function, albeit, possibly at some reduced level of service, in the event that 
Year 2000-induced system failures occur in systems that were converted according 
to schedule. 

That concludes my prepared statement. We welcome any questions that you may 
have. 


Chairman J ohnson of Connecticut. OK. 

Mr. Wiiiemssen. 

STATEMENT OF JOEL C. WILLEMSSEN, DIRECTOR, CIVIL 
AGENCIES INFORMATION SYSTEMS, ACCOUNTING AND 
INFORMATION MANAGEMENT DIVISION, U.S. GENERAL 
ACCOUNTING OFFICE; ACCOMPANIED BY RANDY HITE, 
SENIOR ASSISTANT DIRECTOR, DEFENSE AND 
GOVERNMENTWIDE INFORMATION SYSTEMS, ACCOUNTING 
AND INFORMATION MANAGEMENT DIVISION, U.S. GENERAL 
ACCOUNTING OFFICE 

Mr. WiLLEMSSEN. Thank you, Madam Chair, i am going to very 
briefiy summarize our statement. Accompanying me is Randy Hite 
who is responsibie for much of our work at Treasury components, 


3 Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AiMD- 
10.1.19, Mar. 1998). 
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other than IRS. I'm going to briefly summarize what we found at 
SSA, HCFA, and some of those T reasury components. 

Let me begin with SSA. What we found is SSA is a leader among 
Federal agencies in addressing the year 2000 issue. And they've 
made significant progress in assessing, and renovating mission- 
critical mainframe systems that are essential to the delivery of 
benefits. Flowever, as we reported last fall and as was mentioned 
earlier today, we did find some risks at SSA. Those risks sur- 
rounded States' disability systems, the data exchange issue, and 
contingency planning. And we recommended several actions to 
mitigate those risks. Now SSA has agreed to implement all of our 
recommendations and actions are underway to do that. For exam- 
ple, SSA recently completed a high-level overall plan for ensuring 
business continuity in the event of year 2000 induced failures. 

Next, let me turn to FICFA and Medicare. In our report of last 
year, we discussed the serious weaknesses in FICFA's approach to 
addressing the year 2000 issue. For example, we found that FICFA 
generally did not have agreements with its contractors stating how 
or when the year 2000 problem would be corrected. In addition, 
while FICFA had done some work on its internal systems, it had 
not completed similar reviews of the Medicare contractors claims 
processing systems. In addition, they did not have plans for inde- 
pendent validation of renovation strategies and testing. We made 
several recommendations to FI FIS to address these weaknesses. 
Since then, FICFA has made some progress. The most encouraging 
note is they have clearly made it now a top priority. Flowever, it 
appears the agency still has not determined how its core business 
functions would be affected if its systems fail. 

Finally, let me turn briefly to Treasury. Again, we see some evi- 
dence of progress at the Department but there are key risks re- 
maining. Let me point out one of the more severe risks at one of 
those Treasury components and that is at FMS, which as has been 
mentioned today, plays a critical role in delivering government 
services, such as Social Security and Medicare payments. FMS is 
falling seriously behind schedule in converting some of its systems 
to be year 2000 compliant. For example, as of the end of March, 
FMS still had not completed assessing the compliance of five of its 
mission-critical systems. That's an activity that should have been 
done last summer. Fortunately, Treasury recognizes it now must 
focus on FMS. Department officials have told us that FMS is now 
Treasury's highest bureau priority because of its slow progress and 
because of its overall criticality. 

That summarizes my statement, and, as with Lynda, be pleased 
to address any questions that you may have. 

[The prepared statement follows:] 

statement of J oel C. Willemssen, Director, Civil Agencies Information 

Systems, Accounting and Information Management Division, U.S. General 

Accounting Office 

Madam Chairwoman and Members of the Subcommittee: 

We are pi eased to be here today to discuss the computing chaiienges that the up- 
coming change of century poses to virtuaiiy aii major organizations, pubiic and pri- 
vate, inciuding government programs with a high degree of interaction with the 
American pubiic such as the Sociai Security Administration (SSA) and Medicare. As 
the worid's most advanced and most dependent user of information technoiogy, the 
United States possesses dose to haif of aii computer capacity and 60 percent of 
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Internet assets.^ As a result, the coming century change presents a particularly 
sweeping and urgent challenge for entities in this country . 2 

For this reason, we have designated the Year 2000 computing problem as a high- 
risk area^for the federal government, and have published guidance^ to help organi- 
zations successfully address the issue. Since early 1997 we have issued over 35 
products detailing specific findings and recommendations related to the Year 2000 
readiness of a wide range of federal agencies.^ 

The common theme of these reports has been that serious vulnerabilities remain 
in addressing the federal government's Year 2000 readiness. Much more action is 
needed to ensure that federal agencies satisfactorily mitigate Year 2000 risks to 
avoid debilitating consequences. Vital economic sectors of the nation are also vulner- 
able. These include state and local governments: telecommunications: banking and 
finance: health, safety, and emergency services: transportation: utilities: and manu- 
facturing and small business. 

While actions by government and industry are underway throughout the nation, 
the creation of the President's Council on Year 2000 Conversion represents an op- 
portunity to orchestrate the leadership and public/private partnerships essential to 
confronting the unprecedented challenges that our nation faces. My testimony today 
will briefly outline our views on what additional actions must be taken to reduce 
the nation's Year 2000 risks, and what our inquiries into Year 2000 readiness found 
at Social Security, the Flealth Care Financing Administration (FICFA) and Medicare, 
and at the Department of the Treasury. 

Risk of Year 2000 Disruptions Requires Leadership 

The public faces the risk that critical services could be severely disrupted by the 
Year 2000 computing crisis. Financial transactions could be delayed, airline flights 
grounded, and national defense affected. The many interdependencies that exist 
among the levels of governments and within key economic sectors of our nation 
could cause a single failure to have wide-ranging repercussions. While managers in 
the government and the private sector are acting to mitigate these risks, a signifi- 
cant amount of work remains. 

The federal government is extremely vulnerable to the Year 2000 issue due to its 
widespread dependence on computer systems to process financial transactions, de- 
liver vital public services, and carry out its operations. This challenge is made more 
difficult by the age and poor documentation of many of the government's existing 
systems and its lackluster track record in modernizing systems to deliver expected 
improvements and meet promised deadlines. 

Year 2000-related problems have already occurred. For example, an automated 
Defense Logistics Agency system erroneously deactivated 90,000 inventoried items 
as the result of an incorrect date calculation. According to the agency, if the problem 
had not been corrected (which took 400 work hours), the impact would have seri- 
ously hampered its mission to deliver materiel in a timely manner. ^ 

Our reviews of federal agency Year 2000 programs have found uneven progress, 
and our reports contain numerous recommendations, which the agencies have al- 
most universally agreed to implement. Among them are the need to establish prior- 
ities, solidify data exchange agreements, and develop contingency plans. 

One of the largest, and largely unknown, risks relates to the global nature of the 
problem. With the advent of electronic communication and international commerce, 
the United States and the rest of the world have become critically dependent on 
computers. Flowever, with this electronic dependence and massive exchanging of 
data comes increasing risk that uncorrected Year 2000 problems in other countries 
will adversely affect the United States. And there are indications of Year 2000 read- 
iness problems internationally. In September 1997, the Gartner Group, a private re- 


^Critical Foundations: Protesting America's Infrastructures (President's Commission on Criti- 
cai I nfrastructure Protection, October 1997). 

^For the past severai decades, automated information systems have typicaiiy represented the 
year using two digits rather than four in order to conserve electronic data storage space and 
reduce operating costs. In this format, however, 2000 is indistinguishable from 1900 because 
both are represented only as 00. As a result, if not modified, computer systems or applications 
that use dates or perform date- or time-sensitive calculations may generate incorrect results be- 
yond 1999. 

^High-Risk Series: Information Management and Technology (GAO/H R-97-9, F ebruary 1997). 

‘‘Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD- 10.1.14, September 1997) 
and Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD- 
10.1.19, March 1998 [exposure draft]). 

^A listing of our publications is included as an attachment to this statement. 

^Defense Computers: Issues Confronting DLA in Addressing Year 2000 Problems (GAO/AI M D- 
97-106, August 12, 1997). 
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search firm acknowledged for its expertise in Year 2000 computing issues, surveyed 
2,400 companies in 17 countries and concluded that "[t]hirty percent of all compa- 
nies have not started dealing with theyear 2000 problem."'^ 

Additional Actions Must BeTaken To Reduce Nation's Year 2000 Risks 

As 2000 approaches, the scope of the risks that the century change could bring 
has become more clear, and the federal government's actions have intensified. This 
past February, an executive order was issued establishing the President's Council 
on Year 2000 Conversion. The Council Chair is to oversee federal agency Year 2000 
efforts as well as be the spokesman in national and international forums, coordinate 
with state and local governments, promote appropriate federal roles with respect to 
private-sector activities, and report to the President on a quarterly basis. 

As we testified in March, ^ there are a number of actions we believe the Council 
must take to avert this crisis. In a report issued just last week, we detailed specific 
recommendations. 3 The following summarizes a few of the key areas in which we 
recommend action: 

• Because departments and agencies have taken longer than recommended to as- 
sess the readiness of their systems, it is unlikely that they will be able to renovate 
and fully test all mission-critical systems by J anuary 1, 2000. Consequently, setting 
priorities is essential, with the focus being on systems most critical to our health 
and safety, financial well being, national security, or the economy. 

• Agencies must start business continuity and contingency planning now to safe- 
guard their ability to deliver a minimum acceptable level of services in the event 
of Year 2000-induced failures. I n March we issued an exposure draft of a guide pro- 
viding information on business continuity and contingency planning issues common 
to most large enterprises: 0MB recently adopted this guide as a model for federal 
agencies.i° Agencies developing such plans only for systems currently behind sched- 
ule, however, are not addressing the need to ensure business continuity in the event 
of unforeseen failures. Further, such plans should not be limited to the risks posed 
by the Year 2000-induced failures of internal information systems, but must include 
the potential Year 2000 failures of others, including business partners and infra- 
structure service providers. 

• The Office of Management and Budget's (0MB) assessment of the current sta- 
tus of federal Year 2000 progress is predominantly based on agency reports that 
have not been consistently verified or independently reviewed. Without such inde- 
pendent reviews, 0MB and the President's Council on Year 2000 Conversion have 
little assurance that they are receiving accurate information. Accordingly, agencies 
must have independent verification strategies involving inspectors general or other 
independent organizations. 

• As a nation, we do not know where we stand overall with regard to Year 2000 
risks and readiness. No nationwide assessment— including the private and public 
sectors— has been undertaken to gauge this. In partnership with the private sector 
and state and local governments, the President's Council could orchestrate such an 
assessment. 


Social Security Administration 

At this point I would like to address our findings at specific agencies, beginning 
with the Social Security Administration. We see significant progress at SSA, and it 
is essential that this progress continue. SSA has been anticipating the change of 
century since 1989, initiating an early response to the potential crisis. It made im- 
portant early progress in assessing and renovating mission-critical mainframe sys- 
tems— those necessary to prevent the disruption of benefits— and has been a leader 
among federal agencies. 

Three key risks remained, however, as discussed in our report of last October and 
testimony of this past March. ^ One major risk concerned Year 2000 compliance of 


'’Year 2000-World Status (Gartner Group, Document #vi-i00-037, November 25, 1997). 

^Year 2000 Computing Crisis: Strong Leadership and Effective Public/ Private Cooperation 
Needed to Avoid Major Disruptions (GAOf\'-A\MD-98-101, March 18, 1998). 

3 Year 2000 Computing Crisis: Potential For Widespread Disruption Calls For Strong Leader- 
ship and Partnerships (GAO/Al M D-98-85, Apri I 30, 1998) 
i°GAO/AIMD- 10.1.19, March 1998 [exposure draft]. 

’■^Social Security Administration: Significant Progress Made in Year 2000 Effort, But Key 
Risks Remain (GAO/Al M D-98-6, October 22, 1997) and Social Security Administration: Infor- 
mation Technology Challenges Fadng the Commissioner (GAO/T-AIMD-98-109, March 12, 
1998). 
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the 54 state Disability Determination Services (DDS)i 2 that provide vital support 
to the agency in administering SSA's disability programs. The second major risk 
concerned data exchanges, ensuring that information obtained from these thousands 
of outside sources— such as other federal agencies, state agencies, and private busi- 
nesses— was not "corrupted" by data being passed from systems not Year 2000 com- 
pliant. Third, such risks were compounded by the lack of contingency plans to en- 
sure business continuity in the event of systems failure. 

We recommended several specific actions to mitigate these risks. These included 
(1) strengthening monitoring and oversight of state DDS Year 2000 activities, (2) 
expeditiously completing the assessment of mission-critical systems at DDS offices 
and using those results to establish specific plans of action, (3) discussing the status 
of DDS Year 2000 activities in SSA's quarterly reports to 0MB, (4) quickly complet- 
ing SSA's Year 2000 compliance coordination with all data exchange partners, and 
(5) developing specific contingency plans that articulate clear strategies for ensuring 
the continuity of core business functions. 

At the request of this Committee's Subcommittee on Social Security and the Sen- 
ate Special Committee on Aging, we are monitoring SSA's implementation of our 
recommendations. SSA has agreed with all of our recommendations, and actions to 
implement them have either been taken or are underway. 

Regarding state DDSs, SSA has enhanced its monitoring and oversight by estab- 
lishing a full-time DDS project team, designating project managers and coordina- 
tors, and requesting biweekly status reports. Further, almost all states have now 
submitted initial Year 2000 plans; SSA now reports that 22 DDSs have had their 
systems renovated, tested, and implemented. In addition, beginning with its Novem- 
ber 1997 report, SSA has included information on DDSs in its quarterly reports to 
0MB. 

SSA has also identified its external data exchanges and is in the process of coordi- 
nating with its partners to make the exchanges Year 2000 compliant. Further, SSA 
began working with the Department of the Treasury in March of this year to test 
for the disbursement of benefit checks and other direct deposit payments. 

Finally, in accordance with our guidance, SSA has completed a high-level, overall 
plan for business continuity. This plan represents a sound framework from which 
SSA can build its specific contingency plans. These specific plans— for each core 
business area— need to be developed to ensure that operations continue uninter- 
rupted. 


Medicare and the FIealth Care Financing Administration 

As the nation's largest health insurer. Medicare expects to process over a billion 
claims and pay $288 billion in benefits annually by 2000. The consequences, then, 
of its systems' not being Year 2000 compliant could be enormous. In a report issued 
last May,i^ we discussed the critical managerial and technical challenges facing the 
FIealth Care Financing Administration (FICFA) in its efforts to ensure the viability 
of systems to handle Medicare transactions into the next century. 

We found that FICFA had not required systems contractors to submit Year 2000 
plans for approval. Further, it did not have contracts or other specific legal agree- 
ments with any contractors, other than one recently selected contractor, stating how 
or when the Year 2000 problem would be corrected, or whether contractors would 
certify that they would correct the problem. 

FICFA had also not identified critical areas of responsibility for Year 2000 activi- 
ties. Although FICFA's regional offices have a role in overseeing contractor efforts, 
their specific Year 2000 responsibilities had not been defined, nor had guidance 
been prepared on how to monitor or evaluate contractor performance. While FICFA 
had been assessing the impact of the century change on its internal systems, it had 
not completed a similar review of Medicare contractors' claims processing systems. 
Further, FICFA had not required its contractors to prepare an assessment of the se- 
verity of impact of potential Year 2000 problems. 

Plans for independent validation of contractors' strategies and test plans were 
also lacking. Likewise, while FICFA had asked contractors to identify their system 
interfaces, it had no plans for approving the contractors' approaches for addressing 
interface and data exchange issues. Moreover, FICFA had not developed contingency 
plans to address continuity of business operations in the event of Year 2000-induced 


12 One for each state plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands. 
A federal DDS serves as a backup and model office for testing new technologies and work proc- 
esses. 

i^Mad/care Transaction System: Success Depends Upon Correcting Critical Manageriai and 
Technical Weaknesses {GAO/A\MD-97-78, May 16, 1997). 
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failures. HCFA officials were again relying on the contractors themselves to identify 
and complete the necessary work in time to avoid problems. Yet the contractors had 
not developed contingency plans— and did not intend to— because they considered 
this HCFA's responsibility. 

To address these deficiencies in FICFA’s approach, we made several recommenda- 
tions to the Secretary of Flealth and Fluman Services. These included identifying re- 
sponsibilities for managing and monitoring Year 2000 actions, preparing an assess- 
ment of the severity of impact and timing of potential Year 2000 problems, and de- 
veloping contingency plans. We also recommended that FICFA r^uire its contrac- 
tors to submit for review and approval (1) plans for identifying and correcting poten- 
tial problems, including certification that their changes would correct the problems, 
(2) validation strategies and test plans for systems, and (3) plans for addressing 
interface and data exchange issues. 

The Department of Flealth and Fluman Services (FI FIS) has agreed to implement 
our recommendations. For example, FICFA has established the position of Chief In- 
formation Officer (CIO): this individual has made the Year 2000 issue his top prior- 
ity. FICFA has also established a Year 2000 organization, and the issue is included 
in FICFA's information technology investment process and annual performance plan 
goals. It is also developing business continuity and contingency plans, with a draft 
plan set for release this month. Further, the Medicare carriers' manual has been 
revised to require such contingency planning. 

It should be noted, however, that since our report of last year,!"* FI FIS' and OMB's 
concerns about the Medicare contractors' systems have become more evident. For ex- 
ample, according to FI FIS' February 1998 quarterly Year 2000 report, "FICFA's Medi- 
care contractor systems continue to be of great concern to the Department." I n addi- 
tion, in its summary of all agencies' February 1998 reports, 0MB concluded that 
FIFIS was making insufficient progress on Year 2000 due in large part to FICFA's 
delays. 

There are also indications that the agency has not documented the severity of im- 
pact of Year 2000-related failures— in other words, how its core business functions 
would be affected if its automated information systems failed because of Year 2000- 
related problems. For example, if Medicare systems failed, the number of health 
services providers who would not be paid, paid late, or in incorrect amounts is un- 
known. FICFA has recently begun contingency planning that may address some of 
these issues. We are currently evaluating the effectiveness of FICFA's actions, at the 
request of the Senate Special Committee on Aging. 

Department of the Treasury 

With respect to the Department of the Treasury, we must first point out that— 
unlike with Social Security and Medicare— we have not completed a thorough as- 
sessment of the Department's Year 2000 readiness. Flowever, we can describe some 
of what we have seen, and what Treasury officials themselves report. In addition, 
we have undertaken detailed work at theinternal Revenue Service (I RS), which will 
be discussed in a separate statement today. 

Treasury's role in delivering government services, such as Social Security and 
Medicare payments, is vital. Treasury's Financial Management Service (FMS), for 
instance, as the government's cash receipts and disbursements agent and financial 
manager, represents the crossroads of financial activity for the federal government. 
Flowever, the Department's progress in making systems Year 2000 compliant has 
been mixed. Bureaus such as its Office of Thrift Supervision are making good 
progress in converting their systems and in overseeing the conversion activities of 
the financial institutions that they regulate and inspect. In contrast, FMS is fall- 
ing seriously behind schedule in converting some of its systems. “ Treasury Year 
2000 program officials are aware of these and other related risks facing the Depart- 
ment, and have established program management structures and processes to ad- 
dress them, which we are presently evaluating. 

To perform their core business functions. Treasury and its bureaus rely on a 
vast— and in many cases antiquated— collection of systems, thereby complicating 


14GAO/AIMD-97-78, May 16, 1997. 

^^Year 2000 Computing Crisis: Office of Thrift Supervision's Efforts to Ensure Thrift Systems 
Are Year 2000 Compliant (GAO/T-AI M D-98-102, M arch 18, 1998). 

i^Treasury encompasses 14 separate bureaus or program offices. Two of these— the Internal 
Revenue Service (IRS) and the U.S. Customs Service— account for almost 98 percent of federal 
revenues each year. Two other major bureaus for which Year 2000 compliance implications are 
critical include FMS and the Bureau of the Public Debt. Taken together, these four bureaus are 
instrumental in the efficient collection and payment functions that support beneficiaries of pro- 
grams such as Social Security and Medicare. 
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Year 2000 renovations. To integrate many of the bureaus' systems and permit them 
to interact and exchange information with a wide assortment of federal, state, and 
local government and private-sector data exchange partners (over 6,800, according 
to the Department), Treasury operates and maintains the largest non-Defense tele- 
communications network in the federal government. 

The responsibilities of Treasury's Year 2000 program office are basically twofold: 
guiding, monitoring, and reporting on the conversion activities of its bureaus; and 
converting and reporting on Departmentwide telecommunications systems that sup- 
port its bureaus. To guide, monitor, and report on bureau activities. Treasury has 
(1) established a departmental program office and designated a program manager 
within the CIO organization, (2) established Year 2000 working groups and des- 
ignated work group project managers to focus on major categories of systems, (3) 
issued a departmental Year 2000 conversion strategy, guidance, and standards, and 
(4) established monthly progress reporting requirements. Additionally, it used its ex- 
isting CIO Council as a forum for Year 2000 information exchanges between the De- 
partment and bureau CIOs, hired a contractor to validate the information being re- 
ported by its bureaus, and developed draft guidance governing the process to be 
used in certifying systems as compliant and for verification and validation of certifi- 
cation determinations. 

As a result of this program office oversight. Treasury has a good appreciation of 
where its attention must be focused. Program officials recognize that progress 
among the bureaus has been uneven, as has progress within individual agencies for 
certain categories of systems. For example, they stated that FMS is Treasury's high- 
est priority because of its slow progress to date and the criticality of its role in man- 
aging the government's finances. As a result, according to the Department's Year 
2000 program manager, FMS progress and activities are tracked on a daily basis 
and, consequently, FMS Year 2000 management effectiveness has improved. 

Department Year 2000 officials further report that telecommunications systems 
and non-information technology (IT) areas, such as systems embedded in facilities 
and equipment, are not as far along as other IT areas, such as financial and man- 
agement information systems, because work in these areas started late. To address 
this risk. Treasury has established working groups and project managers for both 
telecommunications and non-IT systems, along with formal processes for guiding, 
monitoring, and reporting on these areas. 

To address the conversion of its telecommunications systems, the program office 
has established a telecommunications working group and designated a project man- 
ager. A risk management plan has also been established, as has a test facility to 
permit all telecommunications systems components to be tested before being placed 
in operation. In addition, a contractor has been hired to perform independent ver- 
ification and validation of telecommunications conversion activities. 

Despite these actions. Treasury and its bureaus face other major risks that must 
be managed effectively if key systems are to be ready in time. For example, the as- 
sessment phase— during which the compliance of mission-critical systems is deter- 
mined— has not been completed. This is worrisome because it reduces the amount 
of time left for critical renovation, validation, and implementation activities. Treas- 
ury's milestone for assessing all mission-critical systems was J uly 1997. Flowever, 
as of the end of March 1998, FMS still had not completed assessing the compliance 
of five of its mission-critical systems. 

For example, according toTreasury's latest status report, FMS is awaiting a con- 
tractor proposal for renovating a system called GOALS I— for Government On-Line 
Accounting Link System I. This system plays a critical role in processing inter- 
agency payments and collections. Of particular note is that the need to assess 
GOALS I for renovation arose only recently, when it became apparent that GOALS 
II, intended to replace GOALS I , will not be ready in time. 

For non-IT systems. Treasury's components are farther behind. As of mid-March, 
systems in 3 of T reasury's 14 bureaus had still not been inventoried. Of the systems 
in the 11 inventoried bureaus, about one quarter remain to be assessed. 

A final risk area is that contingency plans for ensuring continuity of business op- 
erations have not yet been developed. As our guidance points out,i^ business area 
priorities and system dependencies must be examined in light of possible Year 2000- 
induced failures; contingency planning to help ensure continuity of business oper- 
ations must then be developed and tested. 

Although Treasury's Year 2000 program office recognizes the importance of busi- 
ness continuity planning and has issued guidance in this area, bureaus have not yet 
completed such plans, and are at risk of being unable to complete them in time. For 
example, IRS plans to develop contingency plans only for those business areas rely- 


I'^GAO/AIMD- 10.1.19, March 1998 [exposure draft]. 
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ing on systems whose conversions are behind scheduie. With this approach, IRS wiii 
have no ready response to unexpected Year 2000-induced probiems. Further exacer- 
bating this probiem is that devising and activating manuai or contract processes to 
ensure continuity of operations couid be a daunting task. According to a Treasury 
contractor, it may be difficuit for some Treasury components, such as FMS, to for- 
muiatean approach to operating in a nonautomated environment. 

In conclusion, the change of century will present many difficult challenges in in- 
formation technology and in ensuring the continuity of business operations, and has 
the potential to cause serious disruption to the nation and to government entities 
on which the public depends, including SSA, Medicare, and Treasury. These risks 
can be mitigated and disruptions minimized with proper attention and manage- 
ment. While these agencies and programs have been working to mitigate their Year 
2000 risks, further action must be taken to ensure continuity of mission-critical 
business operations. Continued congressional oversight through hearings such as 
this can help ensure that such attention is sustained and that appropriate actions 
are taken to address this crisis. 

Madam Chairwoman, this concludes my statement. I would be happy to respond 
to any questions that you or other members of the Subcommittee may have at this 
time. 


GAO Reports and Testimony Addressing the Year 2000 Crisis 

Year 2000 Computing Crisis: Potential For Widespread Disruption Calis For Strong Leada-- 
ship and Partnerships (GAO/AI M D-98-85, Apri I 30, 1998) 

Defense Computers: Year 2000 Computer Problems Threaten DOD Operations (GAO/AI M D-98- 
72, April 30, 1998) 

Department of the interior: Year 2000 Computing Crisis Presents Risk of Disruption to Ke/ Op- 
erations (GAOn-A\MD-98-lA9, April 22, 1998) 

Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AI MD- 
10.1.19, Exposure Draft, March 1998) 

Tax Administration: IRS' Fiscal Year 1999 Budgdt Request and Fiscal Year 1998 Filing Sea- 
son (GAO/r-GGD/AIMD-98-114, March 31, 1998) 

Year 2000 Computing Crisis: Strong Leadership Needed to Avoid Disruption of Essential Serv- 
ices (GAO/T-AI M D-98- 117, March 24, 1998) 

Year 2000 Computing Crisis: Office of Thrift Supervision's Efforts to Ensure Thrift Systems 
Are Year 2000 Compliant (GAO/T-AI M D-98-102, M arch 18, 1998) 

Year 2000 Computing Crisis: Strong Leadership and Effective Public^ Private Cooperation 
Needed to Avoid Major Disruptions {GAOfY-A\MD-98-101, March 18, 1998) 

Post-Flearing Questions on theF^eral Deposit I nsurance Corporation's Year 2000 (Y2K) Pre- 
paredness (Al M D- 98- 108R, March 18, 1998) 

SEC Year 2000 Report: Future Reports Could Provide More Detailed Information (GAO/GGD/ 
AIMD-98-51, March 6, 1998 

Year 2000 Readiness: NRC's Proposed Approach Regarding Nuclear Powerplants (GAO/AI M D- 
98-90R, March 6, 1998) 

Year 2000 Computing Crisis: Federal Deposit Insurance Corporation's Efforts to Ensure Bank 
Systems AreYear 2000 Compliant {GAOfT-A\MD-98-T3, February 10, 1998) 

Year 2000 Computing Crisis: FAA Must Act Quickly to Prevent Systems Failures (GAO/T- 
AIMD-98-63, February 4, 1998) 

FAA Computer Systems: Limited Progress on Year 2000 Issue Increases Risk Dramatically 
(GAO/AI M D- 98-45, J anuary 30, 1998) 

Dd'ense Computers: Air Force Needs to Strengthen Year 2000 Qversight (GAO/AI MD-98- 35, 
J anuary 16, 1998) 

Year 2000 Computing Crisis: Actions Needed to Address Credit Union Systans' Year 2000 
Problem (GAO/AI M D-98-48, J anuary 7, 1998) 

Veterans Flealth Administration Facility Systems: Some Progress Madein Ensuring Year 2000 
Compliance, But Challenges Remain (GAO/AI M D-98-31R, November 7, 1997) 

Year 2000 Computing Crisis: National Credit Union Administration's Efforts to Ensure Credit 
Union Systems Are Year 2000 Compliant (GAO/T -Al M D-98-20, October 22, 1997) 

Social Security Administration: Significant Progress Made in Year 2000 E ffort, But Key Risks 
Remain (GAO/AI MD-98-6, October 22, 1997) 

Dd'ense Computers: Technical Support Is Key to Naval Supply Year 2000 Success (GAO/ 
AIMD-98-7R, October 21, 1997) 

Dd'ense Computers: LSSC Needs to Confront Significant Year 2000 Issues (GAO/AI MD-97- 
149, September 26, 1997) 

Veterans Affairs Computer Systems: Action Underway Yet Much Work Remains To Resolve 
Year 2000 Crisis (GAO/r-AIMD-97- 174, September 25, 1997) 

Year 2000 Computing Crisis: Success Depends Upon Strong M anagement and Structured Ap- 
proach, (GAO/r-AIMD-97-173, September 25, 1997) 

Year 2000 Computing Crisis: An Assessment Guide (GAO/AI M D- 10.1.14, September 1997) 
Defense Computers: SSG Needs to Sustain Year 2000 Progress (GAO/AI MD-97-120R, August 
19, 1997) 

Defense Computers: Improvements to DQD Systems Inventory Needed for Year 2000 Effort 
(GAO/AI MD- 97- 112, August 13, 1997) 

Dd'ense Computers: Issues Confronting DLA In Addressing Year 2000 Problems (GAO/AI M D- 
97-106, August 12, 1997) 
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Defense Computers: DFAS Faces Challenges In Solving the Year 2000 Problem (GAO/AIMD- 
97-117, August 11, 1997) 

Year 2000 Computing Crisis: Time Is Running Out for Federal Agencies to Prepare for theNe/v 
Miilennium (GAO/T-AI M D- 97- 129, J uly 10, 1997) 

Veterans Bend'its Computer Systems: Uninterrupted Delivery of Bend'its Depends on Timely 
Correction of Year-2000 Problems (GAO/T-AI M D-97-114, J une 26, 1997) 

Veterans Benefits Computers Systems: Risks of VBA's Year-2000 Efforts (GAO/AIM D-97-79, 
M ay 30, 1997) 

Medicare Transaction System: Success Depends Upon Correcting Criticai Managerial and 
Technical Weaknesses (GAO/A\MD-97-78, May 16, 1997) 

Medicare Transaction System: Serious Managerial and Technical l/l/esfcnesses Threaten Mod- 
ernization (GAO/T-AI MD-97-91, May 16, 1997) 

Year 2000 Computing Crisis: Risk of Serious Disruption to Essential Government Functions 
Calls for Agency Action Now {GAOf\'-A\MD-97-52, February27, 1997) 

Year 2000 Computing Crisis: Strong Leadership Today Needed To Prevent Future Disruption 
of Government Services {GAO/T-A\MD-97-51, February 24, 1997) 

Fligh Risk Series: Information Management and Technology (GAO/FIR- 97- 9, February 1997) 


Chairman Johnson of Connecticut. That's a pretty pessimistic 
evaiuation of where we are. How do you respond to the issue of 
personnei that's been raised? How serious do you think that is? 

Ms. Willis, i wouid think for iRS it is a serious probiem. in part 
because many of the key component functions that are now doing 
the year 2000 work were understaffed to begin with, and this in- 
dudes some of the product assurance and testing functions. And so 
when you start in a deficit situation and you start iosing peopie 
through attrition, ieaving the organization, then you have an even 
greater probiem with carrying out what i think is going to be the 
most criticai chaiienge facing iRS. And as the Commissioner noted, 
i think there are some reai questions about the fungi biiity of indi- 
viduais in terms of being abie to do the testing, it is not going to 
be possibie, in many cases, for iRS to just pick peopie up off the 
street, no matter how much money they're wiiiing to pay, who are 
famiiiar enough with the systems to be abie to compiete the testing 
in the time that's avaiiabie. 

Mr. WiLLEMssEN. if i couid speak toward the issue from aiso a 
governmentwide perspective, we are seeing increasing evidence 
that this is an urgent probiem. in fact, we made a recommendation 
in a report that we issued iast week to Mr. Koskinen, the Chair 
of the Y2K Conversion Counci i, that we must have a variety of ac- 
tions in the personnei area to address this. We are seeing more and 
more anecdotai evidence at key departments and agencies that 
they are beginning to iose those personnei. We are seeing some 
positive movement, governmentwicle, for exampie, as i beiieve was 
mentioned eariier. 0PM has put out a waiver of some of the rehir- 
ing of retired annuitants, and aiso we've seen some encouraging ac- 
tion in the way of trying to retain existing staff. Because in some 
cases where we're taiking about very oid systems that are not weii 
documented, you must reiy on your existing staff who are the oniy 
ones immediateiy avaiiabie who reaiiy understand the systems. 

Chairman J ohnson of Connecticut. How aggressive are their in- 
centives to retain existing staff? 

Mr. WiLLEMSSEN. We have seen 

Chairman J ohnson of Connecticut. Are they adequate, are they 
succeeding? 

Mr. WILLEMSSEN. They are succeeding in some regard, but i 
think we're going to have to see more aggressive action, because 
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the unfortunate situation we have here is as the private sector sal- 
aries continue to ratchet up, we're going to have to be even more 
innovative in the Federal Government, and we're going to have to 
take a stance that we just cannot allow certain critical folks to 
leave and we've got to take whatever measures are necessary to do 
that. One key example, I know it's outside the purview of this com- 
mittee, but at the Federal Aviation Administration, there again, we 
have some absolutely critical systems, very old systems, though, 
that only a handful, a cadre of folks know, and it's not really a via- 
ble solution to go out and get contractors support in some cases for 
those kinds of scenarios. So I think we've got to be flexible and be 
alert to the marketplace and whatever the marketplace demands, 
we've got to be responsive to that. 

Ms. Willis. As far as IRS goes, I know that the Commissioner 
has been looking very hard at the new provisions that would allow 
him to rehire retirees without the penalty to the pension, and he 
hopes that if he can pick up even 10 percent of those that it will 
make a significant difference. And at the last steering committee 
meeting, one of the things that was discussed was alternative work 
arrangements and various options that were available to make this 
work attractive to people who have left I RS or to keep people who 
are currently there now. I think there are limitations around the 
issue of how much money people in the Federal Government can 
be paid. And even their retention bonuses and some of the other 
incentives that have been offered, while they're significant for the 
Federal Government, I think one of the open questions is whether 
they will match what's available in the private sector. And I heard 
from the last panel that CIOs working with this were making 
$300,000. Around the issue of the IRS CIO, that may not be high 
enough given the size of I RS' systems and the year 2000 challenge 
that it faces. 

Chairman J ohnson of Connecticut. Flave you developed any, has 
GAO developed any information on what the salaries are in the pri- 
vate sector for the kinds of positions that we see people leaving in 
the Federal Government across the board? 

Mr. WiLLEMssEN. We have an assignment that we have just ini- 
tiated in the personnel area at the request of Chairman Leach so 
that work is just underway to look at the personnel issues and 
those kind of salary ramifications, and we hope to have something 
out additionally on that this summer. 

Chairman j ohnson of Connecticut. OK. We hope to share in 
that. I'll speak to Congressman Leach about that. What about this 
issue of the availability of technology? Flow serious is the problem 
of the telecommunications industry not upgrading their equipment 
promptly? 

Mr. WiLLEMSSEN. The telecommunications area is one of great 
concern to us. I think one of the issues that we need to see more 
movement on from a government wide perspective is there needs to 
be data on telecommunications and exactly what the compliance 
status is right now. Many of the major providers are reluctant to 
date to share much of that data. Mr. Koskinen and his Conversion 
Council have made telecommunications a major priority area. They 
had an initial major meeting, unfortunately much of the discussion 
at that meeting centered around litigation and the reluctance to 
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share data on the compliance status of various telecommunications 
components. I don't think we can go much longer and talk about 
those kind of issues. We've got to get into more exactly where we 
are compliancewise and we've got to be sharing information be- 
cause no matter how good the agencies up before you today are 
going to do, if the telecommunication isn't there. 

Chairman J ohnson of Connecticut. Well, that's my concern but 
you heard from the preceding panel that there also is concern 
about medical equipment and, you know, when you look at all the 
equipment across the board 

Mr. WiLLEMSSEN. There should be concern, again, we have an 
ongoing assignment on biomedical equipment, also, that we're 
doing for the House Veterans' Affairs Committee, and there should 
be concern about that. There are efforts underway to collect data 
on the wide range of biomedical equipment out there and the exact 
nature of what the Y2K issues may be. So there are efforts under- 
way, we just need to more aggressively speed up those efforts. 

Chairman J ohnson of Connecticut. I'd appreciate if you'd give 
some thought to if you were going to formulate a mandate about, 
you know, who in our society ought to be reporting publicly to 
where they are and what the liability protection that you would 
have to give them. I mean, it sounds to me like we're going to need 
an umbrella action here, otherwise you're not going to get the infor- 
mation out in a timely fashion. There has to be some protection so 
I think we need help on that because it would have to move very 
rapidly, it would certainly have to go through J udiciary, it would 
be very controversial, as liability things are. I don't see how you're 
going to get the information you need without it. 

Ms. Willis. Well, M rs. J ohnson, I think, again, the time issue is 
very, very important because we can't wait until December 1999 for 
an agency like IRS that is heavily dependent upon telecommuni- 
cations to do its basic job to move data around the country, and so 
forth. Those systems, ideally, need to be in place early next 
year 

Chairman j ohnson of Connecticut. Right. 

Ms. Willis [continuing]. In time for IRS to be able to test them 
as a component part of its end-to-end testing. 

Chairman j ohnson of Connecticut. If you have any other sugges- 
tions, I mean legislating is slow and then it has to go into effect. 

Ms. Willis. Right. 

Chairman j ohnson of Connecticut. If you have any other sugges- 
tions as to how the Congress could work on this problem. It clearly 
is a very critical problem. And if it's dominating the meetings, all 
that time is not going to the other planning. And it's very, very im- 
portant. 

Mr. WiLLEMSSEN. Totally agree with you. And because of the in- 
creasing amount of attention that this litigation area has received 
recently, we have now initiated some work to get at that as quickly 
as possible and we will share with you as soon as we have our 
overall conclusions and recommendations on that area. 

Chairman j ohnson of Connecticut. When do you expect that to 
be? 

Mr. WiLLEMSSEN. We need to have that by, hopefully, early, 
early summer. 
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Chairman J ohnson of Connecticut. You need to have it before 
then. 

Mr. WiLLEMSSEN. OK. 

Chairman J ohnson of Connecticut. Or at ieast you need to have 
some, we ne^ to have some idea 

Mr. WiLLEMSSEN. Weii, but we can give some preiiminary indica- 
tions very quickiy, just in terms of a finai product 

Chairman Johnson of Connecticut. And the truth is if there's 
going to be any greater pressure put on the resoiution of this prob- 
iem systemicaiiy, we reaiiy have no time at aii to iose because you 
have to get the ideas at ieast into the key committees before the 
May recess so they can germinate over the May recess and then 
possibiy have some iife in J une and, you know, you certainiy you 
can't wait for this stuff to take piace in September. And if you can 
heip deveiop sort of a hierarchy of actions that couid be taken, you 
know, some of them buiiy puipit, some of them iegisiative. it is ex- 
tremeiy concerning to see how terribiy important succeeding on 
this year 2000 project is and what is at stake for us as an economy 
and a society and to see that test companies not giving their up- 
grades soon enough to be tested, you know, couid in a sense destroy 
aii of the good efforts, recognizing that there's pienty of probiems 
on the good effort side. So, i think that and the personnei issue, 
i think the money foiiows those things but i think those are issues 
that we reaiiy have to focus more attention on than i had reaiized 
before this hearing. 

Wouid you eniarge a iittie bit more on this issue of contingency 
pianning? i must say when i see what this Commissioner, and the 
same is true for Nancy Min-DeParie, that they're very capabie peo- 
pie, they've come in, you know, they didn't start in 1989 iike the 
Sociai Security Administration did, and the probiems they face are 
reaiiy extraordinary, i don't know how yourseif as thin as deveiop- 
ing contingency pians which, in my mind, have been sort of backup 
systems, so i was interested that you indicated that you indicated 
that you thought there were contingency pians that didn't con- 
stitute backup systems, and i'd iike you to give me a iittie dearer 
idea of what you mean by that. 

Ms. Willis. Weii, Madam Chairman, it couid be things such as 
changes in how they operate certain types of business processes. 
Now, obviousiy with iRS to go to a manuai process, as somebody 
noted, for 90 miiiion refunds is not viabie but there may be dates 
that couid be changed for certain statutory requirements, such as 
fiiing requirements. You couid deiay the impact of some of these 
things on systems that are not ready yet. i'm just saying that i 
think we need to start at the very beginning and iook at what the 
desired outcome of the process is and iook at the timing of it and 
turn it and twist it every which way to see how biocks start fitting 
together to address the vuinerabiiities and the potentiai probiems. 

One of the things with the tax system is that you're taiking such 
a huge base, both in the number of taxpayers and in terms of doi- 
iars, that it doesn't take very iong to start racking up a iot of costs 
indirectiy around any kind of probiem, any kind of deiay. it might 
be easier and cheaper to fix in anticipation. 

But i guess my concern right now is that we're not at a point 
where we truiy understand what the contingencies and the risks in 
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a concrete fashion are that are ahead of I RS as they move into test- 
ing. As witnesses testified eariier, and i beiieve as J oei has in his 
testimony, testing is taking much, much ionger than peopie antici- 
pated and, so i think one of the things that you do as a contingency 
pian is that you keep that year that you've set aside as sacrosanct. 

One of the things that came up earlier today was mainframe con- 
solidation at I RS. Not all of the component parts of mainframe con- 
solidation are necessary to make the systems year 2000 compliant. 
One of the questions that needs to be on the table is whether it 
is necessary to roll out those additional service centers in 1999, or 
whether that management talent, those resources, and the energy 
that's involved with that is better placed elsewhere. And I think 
there are other things throughout the agency in terms of setting 
priorities 

Chairman Johnson of Connecticut. On that particular issue, 
have you looked closely at the tradeoff between, you know, the cen- 
ter operations and the fact that they will be not only new tech- 
nology but very much more capable and simplified system down 
through— in other words, they have a lot of ramifications for the 
systems, is that not worth the management investment now? Can 
you really modernize all of the complex old stuff? It seems to me 
that it might be better to push ahead with some of these. 

Ms. Willis. Well, I think there's two things to be considered. 
One is exactly how much modernization you're getting from the 
consolidation effort. And most of the benefits that IRS estimated 
that it would receive, and those are currently under reevaluation 
because of slippages in the schedule, came from reducing the num- 
ber of people they needed to have around the country managing 
their various computing operations. So the applications are not 
changing as they move to this new platform. They're basically 
doing business in a lot of the same ways but at a different location 
in a consolidated environment. So I'm not sure that you're getting 
a whole lot through that process in terms of actual modernization. 
You're getting more current computers but they are able to make, 
and will be making, the existing computers year 2000 compliant. 
And I'm not suggesting that consolidation is not something that 
you don't want to do at all, but something that maybe you want 
to delay for a year as a tradeoff in terms of the risks that you're 
undertaking around it and I think that's an issue that needs to be 
looked at very carefully, not only for consolidation but in the other 
part of the system that's going to be undergoing replacement, and 
so forth. 

Mr. WiLLEMssEN. If I could add a couple of points also. Madam 
Chair. Contingency planning is probably the topic we've gotten the 
most traffic on in the last few months. The item that people want 
to know how to do. So at the request of the executive branch, we 
did put together a guide in March of this year on how to go about 
and how to do contingency planning. A couple of points to make re- 
lated to that 

Chairman Johnson of Connecticut. I'll hope you'll share that 
with the Subcommittee. 

Mr. WiLLEMSSEN. Definitely. 

Chairman J ohnson of Connecticut. It would be very useful to us. 
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Mr. WiLLEMSSEN. Definitely. A couple of points to consider relat- 
ed to that is our contingency planning needs to be focused on back- 
ing up business processes more so than individual systems. That 
is, how do we go about delivering our service? And if there's a Y2K 
induced failure that prevents us from doing that, what are we 
going to do instead? So we have to think of it from a business per- 
spective and a little less so from a system perspective although 
there's obviously a relationship and integration to consider. Given 
that, we would expect the business side of the House, generally 
speaking, to take the lead in putting these kind of plans together 
with the involvement, obviously, of the information technology 
staff, including the year 2000 personnel. But the business side of 
the House, they're the ones that know how they deliver services. 
They're the ones in the best position to know 

Chairman J ohnson of Connecticut. In other words, the contin- 
gency planning people don't necessarily have to be the same as the 
system reform people? 

Mr. WiLLEMSSEN. That'S exactly right. You need to involve them 
but it's not necessarily a tradeoff issue. Ironically, the organization 
in the Federal Government furthest ahead on this is the Social Se- 
curity Administration. And there's a point to be made there too. We 
don't do contingency plans just because we're falling behind. You 
do them r^ardless, because of the unforeseen circumstances that 
could hit like the telecommunications issue that we talked about 
earlier. And SSA has put together a very sound structure for an 
overall business continuity and contingency plan. 

Chairman J ohnson of Connecticut. Do you foresee any problem 
with the government being able to get the technology it needs 

Mr. WiLLEMSSEN. I would say 

Chairman J ohnson of Connecticut [continuing]. The computers, 
and the number of parts? 

Mr. WiLLEMSSEN. I would say from what we see at selected agen- 
cies, is there are a lot of, should I say, "to-be-determined," as it per- 
tains to commercial off-the-shelf products and what their year 2000 
compliance status is. And a lot of those commercial off-the-shelf 
products are absolutely crucial to the operation of key business 
functions. 

Chairman J ohnson of Connecticut. Are we going to test commer- 
cial off-the-shelf components? 

Mr. WiLLEMSSEN. One of the things that the executive branch is 
doing is setting up a separate test facility for commercial off-the- 
shelf products. SSA and GSA are beginning to do that and then 
they will put the results up on a Web site so beyond just the manu- 
facturer's claim that it's compliant, there will be some independent 
testing to that effect. 

Chairman j ohnson of Connecticut. Good. 

Ms. Willis. Madam Chairman, the one thing that I would add 
is what we found at IRS. Part of the problem with their existing 
systems is that the contractors or the vendors are no longer sup- 
porting some of the commercial off-the-shelf, or COTS, products. I 
think, agencies with old systems, much like IRS, are going to run 
into this problem as well and you're running out of time in terms 
of deciding what your alternatives are. And at IRS, for example, 
that's one of the big concerns around the tier 2 systems, j ust now. 
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after months and months and months of negotiations, IRS has re- 
ceived the beta version of some of the operating systems that they 
need and they've got a massive number of platforms, a massive 
number of applications that all have to be testing on this new oper- 
ating system. And so it's not as easy as with a new company, per- 
haps, that can simply go down to their local vendor and buy the 
latest year 2000 upgrade. A lot of these systems simply aren't sup- 
ported any more. 

Chairman Johnson of Connecticut. Which aspects of the IRS 
year 2000 effort do you believe are least likely to be completed by 
J anuary 1999? 

Ms. Willis. I think there are serious concerns around some as- 
pects of the mainframe consolidation, especially the parts that 
must be completed for I RS to be year 2000 compliant, like CRS, the 
Communication Replacement System. They are running into some 
slippages, some delays and one of the things that we've learned as 
we've watched over the past year as things start to slip and time 
starts to domino that it's much harder to get things back on track 
along that line. They have problems with their tier 2 systems, 
again, because of the variety of platforms that they're working on 
as well as the large number or applications across the country, 
many of which are not standardized so they have to do different 
things in different places. 

And I think the thing that I would put at the top of the list is 
testing. IRS does not currently have an integrated test plan for all 
of its conversion and replacement efforts. So right now it's not real 
clear, come J anuary 1999, how they are going to test everything. 
And a comment I would make on some of the things that I heard 
earlier this morning from one of the prior panelists is be sure that 
everybody understands what we're talking about when we talk 
about things being completed. IRS, for example, has completed the 
conversion of a number of its main applications and those are run- 
ning this filing season. But those applications have not been tested 
on, or may not be running on year 2000 compliant platforms nor 
in an integrated environment. So we're not home free on the sys- 
tems that are running this year, or that will run next year and run 
successfully through the filing season. 

Chairman J ohnson of Connecticut. I see, interesting. Thank you 
very much. I appreciate your testimony today and look forward to 
working with you. 

The hearing will be adjourned. 

[Whereupon, at 1:42 p.m., the hearing was adjourned, subject to 
the call of the Chair.] 
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